RANSOM_ENTREPED.A

This Ransomware executes then deletes itself afterward.

It modifies the Internet Explorer Zone Settings.

It encrypts files found in specific folders. It drops files as ransom note.

Installation

This Ransomware drops a copy of itself in the following folders using different file names:

• %AppDataLocal%\{Random 1}\{Random 2}.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system and executes them:

• %AppDataLocal%\{Random 3}\{Random 4}.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %AppDataLocal%\{Random 5}:exe -> used to run net.exe
• %AppDataLocal%\{Random 6}:exe -> used to run vssadmin.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• %System%\net.exe view
• %System%\net.exe view \{Computer Name}
• %System%\vssadmin.exe Delete Shadows /All /Quiet

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It executes then deletes itself afterward.

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Characters} = "%AppDataLocal%\{Random 1}\{Random 2}.exe"

Other System Modifications

This Ransomware deletes the following folders:

• {Malware Path}\

Web Browser Home Page and Search Page Modification

This Ransomware modifies the Internet Explorer Zone Settings.

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• %System Root%
• %Program Files%
• All Drives

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It avoids encrypting files with the following strings in their file name:

• System Volume Information
• $RECYCLE.BIN
• WebCache
• Caches
• svsho*.exe
• schre*.bat
• V01.lo*
• V01.ch*
• V01res*.jrs
• RacWmi*.sdf
• Web*V01.dat
• svsho*.exe
• *.locked
• *.readme_txt

It avoids encrypting files found in the following folders:

• %ProgramData%\Microsoft\Windows\WER\ReportQueue\
• %Windows%\
• %User Temp%\

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It appends the following extension to the file name of the encrypted files:

• .locked

It drops the following file(s) as ransom note:

• {Encrypted File Path}\{Encrypted File}.readme_txt

It leaves text files that serve as ransom notes containing the following text: