Ransom.Win32.CRYLOCK.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %User Temp%\svc{3 random letters}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %User Temp%\svc{3 random letters}.exe
• cmd.exe /c "ping 0.0.0.0&del "{malware filepath}\{malware filename}.exe""
• vssadmin.exe delete shadows /all /quiet
• wbadmin.exe DELETE SYSTEMSTATEBACKUP -keepVersions:0
• wbadmin.exe DELETE BACKUP -keepVersions:0
• wbem\WMIC.exe SHADOWCOPY DELETE
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• mshta.exe "%User Temp%\how_to_decrypt.hta"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It executes then deletes itself afterward.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Generated ID}

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Generated ID} = "%User Temp%\svc{3 random letters}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Generated ID}hta = "%User Temp%\how_to_decrypt.hta"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random numbers} = {random numbers}

Other Details

This Ransomware does the following:

• It empties the Recycle Bin

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• how_to_decrypt.hta
• %User Temp%\svc{3 random letters}.exe → its dropped copy

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It avoids encrypting files with the following strings in their file path:

• Windows
• Recycler

It appends the following extension to the file name of the encrypted files:

• [{Malicious Email}][{Generated ID}].{3 random letters}
  • where
    • {Malicious Email} can be one of the following:
      • {BLOCKED}ry@{BLOCKED}ail.com
      • {BLOCKED}y@{BLOCKED}.me
    • {Generated ID} is unique for every infected machine
    • {3 random letters} is different for every encrypted file

It drops the following file(s) as ransom note:

• %User Temp%\how_to_decrypt.hta
• {Encrypted Directory}\how_to_decrypt.hta
  

It avoids encrypting files with the following file extensions:

• .bat
• .bmp
• .dll
• .ini
• .log
• .sys