Ransom.Win32.CONTI.FAJF

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Log File Path}\{Log Filename} → If -log argument is used

It adds the following processes:

• cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{Shadowcopy ID}'" delete → repeated depending on the number of shadow copies

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• YUIOGHJKCVVBNMFGHJKTYQUWIETASKDHGZBDGSKL237782321344

Other Details

This Ransomware does the following:

• It uses the Windows Restart Manager to unlock files it will encrypt.
• When encrypting network shares it will check if the IP address starts with the following to ensure that it is encrypting local, non-Internet, systems:
  • 172.
  • 192.168.
  • 10.
  • 169.
• It accepts the following parameters:
  • -m {all|local|net|backups}
  • all - combination of net and local
  • local - delete backups and encrypt only locally found drives
  • net - delete backups and encrypt only network shares
  • backups - delete backups
  • -p {Directory} - Will encrypt first the folders in the list before proceeding to the others
  • -log {Log File Path}\{Log Filename} - Log output to {Log File Path}\{Log Filename}
  • -nomutex - Creates no mutex allowing multiple process
  • -size {chunk mode}
• By default, it encrypts local drives, removable drives and network shares

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• readme.txt
• CONTI_LOG.txt

It avoids encrypting files with the following strings in their file path:

• tmp
• winnt
• temp
• thumb
• $Recycle.Bin
• $RECYCLE.BIN
• System Volume Information
• Boot
• Windows
• Trend Micro
• Perflogs

It appends the following extension to the file name of the encrypted files:

• .PSFUX

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\readme.txt
  

It avoids encrypting files with the following file extensions:

• .PSFUX
• .exe
• .dll
• .lnk
• .sys
• .msi
• .bat