Ransom.MSIL.CHAOS.E

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %Application Data%\svchost.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\{9 random characters}.jpg → Used as wallpaper

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %Application Data%\svchost.exe
• "%System%\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
• "%System%\cmd.exe" /C bcdedit /set {default} bootstatus policy ignoreallfailures & bcdedit /set {default} recoveryenabled no
• "%System%\cmd.exe" /C wbadmin delete catalog -quiet
• "%System%\NOTEPAD.EXE" %Application Data%\CryptBIT-restore-files.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Microsoft Store = %Application Data%\svchost.exe

It drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\svchost.url

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Ransomware changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{9 random characters}.jpg

It sets the system's desktop wallpaper to the following image:

• %User Temp%\{9 random characters}.jpg
  

Propagation

This Ransomware drops copies of itself in the following drives:

• {Available Drive aside C:}\surprise.exe

Other Details

This Ransomware does the following:

• It encrypts files with file size below 2,117,152 bytes.
• It randomly encrypts files with file size above 2,117,152 bytes rendering the file unusable.
• It hijacks Windows clipboard to monitor crypto addresses; in event detected changes crypto address with the following:
  • {BLOCKED}ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg
  • {BLOCKED}FeuB3NTzJ2X28tfRmWaPyPQgvoHV

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .txt
• .jar
• .dat
• .contact
• .settings
• .doc
• .docx
• .xls
• .xlsx
• .ppt
• .pptx
• .odt
• .jpg
• .mka
• .mhtml
• .oqy
• .png
• .csv
• .py
• .sql
• .mdb
• .php
• .asp
• .aspx
• .html
• .htm
• .xml
• .psd
• .pdf
• .xla
• .cub
• .dae
• .indd
• .cs
• .mp3
• .mp4
• .dwg
• .zip
• .rar
• .mov
• .rtf
• .bmp
• .mkv
• .avi
• .apk
• .lnk
• .dib
• .dic
• .dif
• .divx
• .iso
• .7zip
• .ace
• .arj
• .bz2
• .cab
• .gzip
• .lzh
• .tar
• .jpeg
• .xz
• .mpeg
• .torrent
• .mpg
• .core
• .pdb
• .ico
• .pas
• .db
• .wmv
• .swf
• .cer
• .bak
• .backup
• .accdb
• .bay
• .p7c
• .exif
• .vss
• .raw
• .m4a
• .wma
• .flv
• .sie
• .sum
• .ibank
• .wallet
• .css
• .js
• .rb
• .crt
• .xlsm
• .xlsb
• .7z
• .cpp
• .java
• .jpe
• .ini
• .blob
• .wps
• .docm
• .wav
• .3gp
• .webm
• .m4v
• .amv
• .m4p
• .svg
• .ods
• .bk
• .vdi
• .vmdk
• .onepkg
• .accde
• .jsp
• .json
• .gif
• .log
• .gz
• .config
• .vb
• .m1v
• .sln
• .pst
• .obj
• .xlam
• .djvu
• .inc
• .cvs
• .dbf
• .tbi
• .wpd
• .dot
• .dotx
• .xltx
• .pptm
• .potx
• .potm
• .pot
• .xlw
• .xps
• .xsd
• .xsf
• .xsl
• .kmz
• .accdr
• .stm
• .accdt
• .ppam
• .pps
• .ppsm
• .1cd
• .3ds
• .3fr
• .3g2
• .accda
• .accdc
• .accdw
• .adp
• .ai
• .ai3
• .ai4
• .ai5
• .ai6
• .ai7
• .ai8
• .arw
• .ascx
• .asm
• .asmx
• .avs
• .bin
• .cfm
• .dbx
• .dcm
• .dcr
• .pict
• .rgbe
• .dwt
• .f4v
• .exr
• .kwm
• .max
• .mda
• .mde
• .mdf
• .mdw
• .mht
• .mpv
• .msg
• .myi
• .nef
• .odc
• .geo
• .swift
• .odm
• .odp
• .oft
• .orf
• .pfx
• .p12
• .pl
• .pls
• .safe
• .tab
• .vbs
• .xlk
• .xlm
• .xlt
• .xltm
• .svgz
• .slk
• .tar.gz
• .dmg
• .ps
• .psb
• .tif
• .rss
• .key
• .vob
• .epsp
• .dc3
• .iff
• .onepkg
• .onetoc2
• .opt
• .p7b
• .pam
• .r3d

It encrypts files found in the following folders:

• The following specific folders in C drive:
  • %Desktop%
  • %User Profile%\Links
  • %User Profile%\Contacts
  • %Desktop%
  • %User Profile%\Documents
  • %User Profile%\Downloads
  • %User Profile%\Pictures
  • %User Profile%\Music
  • %User Profile%\OneDrive
  • %User Profile%\Saved Games
  • %Favorites%
  • %User Profile%\Searches
  • %User Profile%\Videos
  • %Application Data%
  • %Public%\Documents
  • %Public%\Pictures
  • %Public%\Music
  • %Public%\Videos
  • %Public%\Desktop
• In other available drives

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It avoids encrypting files with the following strings in their file name:

• CryptBIT-restore-files.txt

It appends the following extension to the file name of the encrypted files:

• .cryptbit

It drops the following file(s) as ransom note:

• {Encrypted Folder}\CryptBIT-restore-files.txt
• %Application Data%\CryptBIT-restore-files.txt