Ransom.Win32.LCRY.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Windows%\system32lrk.dat
• %Windows%\system32lri.dat
• {Malware File Path}\Code.key ← decoy decryption key
• %Desktop%\@Decryptor@.exe ← Copy of application that loaded the malware file
• %Windows%\system32lrw.bmp
• {Malware File Path}\PasswordEnter.txt

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

• %Windows%\system32lrw.bmp
  

Other Details

This Ransomware does the following:

• It encrypts all available logical drives from A -Z.
  • If the drive being encrypted is C drive it only encrypts the %Desktop% and %User Profile%\Documents folders.
• It checks if system32lrk.dat and system32lri.dat exists in the affected machine's %Windows% folder.
  • If it exists, it opens {Malware File Path}\PasswordEnter.txt and asks the user to enter a key on the file for 60 seconds.
  • If the correct key is entered within 60 seconds, it decrypts its encrypted files then restart the affected machine.
  • If not, it shows the following message box then restart the affected machine.
    
    
  • If it does not exist, it encrypts the files in the affected machine.
• It attempts to load the file 'vcruntime140Org.dll'
  • If the file is not loaded, it displays the following message box:
    
• It displays its ransom note after encryption through a message box:
  

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• {Existing File Extension}_lcry_enc

It avoids encrypting files with the following file extensions:

• {Existing File Extension}_lcry_enc