Ransom.Win32.LCRY.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Windows%\system32lrk.dat
• %Windows%\system32lri.dat
• {Malware File Path}\Code.key ← decoy decryption key
• %Desktop%\@Decryptor@.exe ← Copy of application that loaded the malware file
• %Windows%\system32lrw.bmp
• {Malware File Path}\PasswordEnter.txt

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Otras modificaciones del sistema

Este malware establece la imagen siguiente como fondo de escritorio del sistema:

• %Windows%\system32lrw.bmp
  

Otros detalles

Hace lo siguiente:

• It encrypts all available logical drives from A -Z.
  • If the drive being encrypted is C drive it only encrypts the %Desktop% and %User Profile%\Documents folders.
• It checks if system32lrk.dat and system32lri.dat exists in the affected machine's %Windows% folder.
  • If it exists, it opens {Malware File Path}\PasswordEnter.txt and asks the user to enter a key on the file for 60 seconds.
  • If the correct key is entered within 60 seconds, it decrypts its encrypted files then restart the affected machine.
  • If not, it shows the following message box then restart the affected machine.
    
    
  • If it does not exist, it encrypts the files in the affected machine.
• It attempts to load the file 'vcruntime140Org.dll'
  • If the file is not loaded, it displays the following message box:
    
• It displays its ransom note after encryption through a message box: