RANSOM_CRYPSHED.BZV

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %All Users Profile%\Application Data\Windows\csrss.exe (Windows XP and below)
• %All Users Profile%\Windows\csrss.exe (Windows Vista and above)

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Client Server Runtime Subsystem = %All Users Profile%\Windows\csrss.exe (Windows Vista and above)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Client Server Runtime Subsystem = %All Users Profile%\Application Data\Windows\csrss.exe (Windows XP and below)

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xVersion = 4.0.0.1

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xpk = {PUBLIC KEY}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xmode = {mode}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xi = {ID}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xstate = {state}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
xcnt = {encrypted files count}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
shsnt = {number}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
shst = {number}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
sh1 = {random}

HKEY_LOCAL_MACHINE\SOFTWARE\System32\
Configuration
sh2 = {random}

It sets the system's desktop wallpaper to the following image:

Dropping Routine

This Ransomware drops the following files:

• %User Temp%\6893A5D897\lock
• %User Temp%\6893A5D897\state
• %User Temp%\6893A5D897\unverified-microdesc-consensus
• %User Temp%\6893A5D897\cached-certs
• %User Temp%\6893A5D897\cached-microdesc-consensus
• %User Temp%\6893A5D897\cached-microdescs.new
• {drive letter}:\README{1-10}.txt → Ransom Note
• {folder containing encrypted files}\README.txt → Ransom Note
• %ProgramData%\System32\xfs (Hidden) → Contains list of encrypted files

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• http://whatismyipaddress.com/
• http://whatsmyip.net/

It connects to the following website to send and receive information:

• http://{server}/{path}
  where {server} can be any of the following:
  • {BLOCKED}.{BLOCKED}.40.189
  • {BLOCKED}.{BLOCKED}.0.39
  • {BLOCKED}.{BLOCKED}.176.148
  • {BLOCKED}.{BLOCKED}.81.226
  • {BLOCKED}.{BLOCKED}.232.207
  • {BLOCKED}.{BLOCKED}.225.155
  • {BLOCKED}.{BLOCKED}.249.221
  • {BLOCKED}.{BLOCKED}.6.199
  • {BLOCKED}.{BLOCKED}.221.166
  • {BLOCKED}.{BLOCKED}.220.54
  • {BLOCKED}xclh6fd.onion
  
  where {path} can be any of the following:
  
  • reg.php
  • prog.php
  • err.php
  • cmd.php
  • sys.php
  • shd.php

It encrypts files with the following extensions:

• .1cd
• .3ds
• .3fr
• .3g2
• .3gp
• .7z
• .accda
• .accdb
• .accdc
• .accde
• .accdt
• .accdw
• .adb
• .adp
• .ai
• .ai3
• .ai4
• .ai5
• .ai6
• .ai7
• .ai8
• .anim
• .arw
• .as
• .asa
• .asc
• .ascx
• .asm
• .asmx
• .asp
• .aspx
• .asr
• .asx
• .avi
• .avs
• .backup
• .bak
• .bay
• .bd
• .bin
• .bmp
• .bz2
• .c
• .cbf
• .cdr
• .cer
• .cf
• .cfc
• .cfm
• .cfml
• .cfu
• .chm
• .cin
• .class
• .clx
• .config
• .cpp
• .cr2
• .crt
• .crw
• .crypted
• .cs
• .css
• .csv
• .cub
• .dae
• .dat
• .db
• .dbf
• .dbx
• .dc3
• .dcm
• .dcr
• .der
• .dib
• .dic
• .dif
• .divx
• .djvu
• .dmp
• .dng
• .doc
• .docm
• .docx
• .dot
• .dotm
• .dotx
• .dpx
• .dqy
• .dsn
• .dt
• .dtd
• .dwg
• .dwt
• .dx
• .dxf
• .edml
• .efd
• .elf
• .emf
• .eml
• .emz
• .epf
• .eps
• .epsf
• .epsp
• .erf
• .exr
• .f4v
• .fbk
• .fdb
• .fido
• .fld
• .flm
• .flv
• .frm
• .fxg
• .geo
• .gif
• .grs
• .gz
• .h
• .hdr
• .hpp
• .hta
• .htc
• .htm
• .html
• .icb
• .ics
• .iff
• .inc
• .indd
• .ini
• .iqy
• .j2c
• .j2k
• .java
• .jp2
• .jpc
• .jpe
• .jpeg
• .jpf
• .jpg
• .jpx
• .js
• .jsf
• .json
• .jsp
• .kdc
• .kmz
• .kwm
• .lasso
• .lbi
• .lgf
• .lgp
• .log
• .lst
• .m1v
• .m4a
• .m4v
• .max
• .md
• .mda
• .mdb
• .mde
• .mdf
• .mdw
• .mef
• .mft
• .mfw
• .mht
• .mhtml
• .mka
• .mkidx
• .mkv
• .mos
• .mov
• .mp3
• .mp4
• .mpeg
• .mpg
• .mpv
• .mrw
• .msg
• .mtr
• .mxl
• .myd
• .myi
• .nef
• .nrw
• .obj
• .odb
• .odc
• .odm
• .odp
• .ods
• .oft
• .one
• .onepkg
• .onetoc2
• .opt
• .oqy
• .orf
• .p12
• .p7b
• .p7c
• .pam
• .pbm
• .pct
• .pcx
• .pdd
• .pdd
• .pdf
• .pdp
• .pef
• .pem
• .pff
• .pfm
• .pfx
• .pgm
• .php
• .php3
• .php4
• .php5
• .phtml
• .pict
• .pl
• .pls
• .pm
• .png
• .pnm
• .pot
• .potm
• .potx
• .ppa
• .ppam
• .ppm
• .pps
• .ppsm
• .ppt
• .pptm
• .pptx
• .prn
• .ps
• .psb
• .psd
• .pst
• .pst
• .ptx
• .pub
• .pwm
• .pxr
• .py
• .qt
• .r3d
• .raf
• .rar
• .raw
• .rdf
• .rgbe
• .rle
• .rqy
• .rss
• .rtf
• .rw2
• .rwl
• .safe
• .sct
• .sdpx
• .shtm
• .shtml
• .slk
• .sln
• .sql
• .sr2
• .srf
• .srw
• .ssi
• .st
• .stm
• .svg
• .svgz
• .swf
• .tab
• .tar
• .tbb
• .tbi
• .tbk
• .tdi
• .tga
• .thmx
• .tib
• .tif
• .tiff
• .tld
• .torrent
• .tpl
• .txt
• .u3d
• .udl
• .uxdc
• .vault
• .vb
• .vbk
• .vbm
• .vbs
• .vcs
• .vda
• .vdr
• .vdw
• .vdx
• .vhd
• .vib
• .vrp
• .vsd
• .vss
• .vst
• .vsw
• .vsx
• .vtm
• .vtml
• .vtx
• .wav
• .wb2
• .wbm
• .wbmp
• .wim
• .wmf
• .wml
• .wmv
• .wpd
• .wps
• .x3f
• .xl
• .xla
• .xlam
• .xlk
• .xlm
• .xls
• .xlsb
• .xlsm
• .xlsx
• .xlt
• .xltm
• .xltx
• .xlw
• .xml
• .xps
• .xsd
• .xsf
• .xsl
• .xslt
• .xsn
• .xtp
• .xtp2
• .xyze
• .xz
• .zip

It renames encrypted files using the following names:

• {random characters}=.{ID}.no_more_ransom

It does the following:

• It delets shadow copies by executing the following commands:
  • %System%\vssadmin.exe Delete Shadows /All /Quiet

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:

The ransom note contains the following message: