RANSOM_CRYPCTB.VXXT

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Temp%\{random filename}.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %My Documents%\!Decrypt-All-Files-{7 random characters}.txt
• %My Documents%\!Decrypt-All-Files-{7 random characters}.bmp

  (Note: %My Documents% is usually C:\Documents and Settings\{user name}\My Documents on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Documents on Windows Vista and 7.)

• %All Users Profile%\{random characters}.html

  (Note: %All Users Profile% is usually C:\Documents and Settings\All Users on Windows 2000, XP, and Server 2003, or C:\Users\All Users on Windows Vista and 7.)

• %System Root%\{randomly selected path}\!Decrypt-All-Files-{7 random characters}.txt
• %System Root%\{randomly selected path}\!Decrypt-All-Files-{7 random characters}.bmp
• %Tasks%\{random filename}

  (Note: %Tasks% is usually C:\Windows\Tasks on Windows XP and below, or C:\Windows\system32\Tasks on Windows Vista and above)

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

This Trojan drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\system.pif - malware copy

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other System Modifications

This Trojan modifies the following file(s):

• It encrypts files and appends the extension .{7 random characters} to the encrypted files.
  Example sample.txt.qwkooom

It modifies the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = "%My Documents%\!Decrypt-All-Files-{7 random characters}.bmp"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_CURRENT_USER\Control Panel\Desktop
TileWallpaper = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = "0"

(Note: The default value data of the said registry entry is {user-defined}.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}aew3e7ao3q.onion.cab
• http://{BLOCKED}aew3e7ao3q.onion.lt
• http://{BLOCKED}aew3e7ao3q.onion.gq
• http://{BLOCKED}aew3e7ao3q.tor2web.org
• http://{BLOCKED}aew3e7ao3q.tor2web.fi
• http://{BLOCKED}ew3e7ao3q.tor2web.blutmagie.de