RANSOM_CRYPWALL.CBQ157S

Infection Channel: Downloaded from the Internet

This Trojan modifies registry entries to disable various system services. This action prevents most of the system functions to be used.

It does not have any propagation routine.

It does not have any backdoor routine.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

File Size: 246,332 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 11 Aug 2015

Payload: Connects to URLs/IPs, Encrypts files

Installation

This Trojan drops the following copies of itself into the affected system:

%System Root%\{random 8 characters}\{random 8 characters}.exe
%Application Data%\{random 8 characters}.exe
%User Startup%\{random 8 characters}.exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It drops the following files:

%User Startup%\HELP_DECRYPT.HTML
%User Startup%\HELP_DECRYPT.PNG
%User Startup%\HELP_DECRYPT.TXT
%User Startup%\HELP_DECRYPT.URL

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It drops and executes the following files:

%Desktop%\HELP_DECRYPT.HTML
%Desktop%\HELP_DECRYPT.PNG
%Desktop%\HELP_DECRYPT.TXT
%Desktop%\HELP_DECRYPT.URL

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

explorer.exe
svchost.exe

It is injected into the following processes running in memory:

created explorer.exe
created svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random 7 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random 8 characters} = "%Application Data%\{random 8 characters}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
*{random 6 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe" (for Windows Vista and above only)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
*{random 7 characters} = "%Application Data%\{random 8 characters}.exe" (for Windows Vista and above only)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\{UID}

HKEY_CURRENT_USER\Software\{UID}\
{random key}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{UID}
{random 2 characters} = "{contents of HELP_DECRYPT.URL}"

HKEY_CURRENT_USER\Software\{UID}
{random 2 characters} = "{contents of HELP_DECRYPT.TXT}"

HKEY_CURRENT_USER\Software\{UID}
{random 2 characters} = "{contents of HELP_DECRYPT.HTML}"

HKEY_CURRENT_USER\Software\{UID}
{random 2 characters} = "{RSA PUBLIC KEY}"

HKEY_CURRENT_USER\Software\{UID}\
{random key}
{Path and file of encrypted file} = "{hex values}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

(Note: The default value data of the said registry entry is 0.)

It modifies registry entries to disable the following system services:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Information Theft

This Trojan gathers the following data:

Unique Identifier (UID)
Machine Screenshot

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

http://ip-addr.es
http://myexternalip.com/raw
http://curlmyip.com

It connects to the following website to send and receive information:

http://{BLOCKED}a.kz/wp-content/plugins/wp-db-backup-made/a.php?{random letter}={random values}
http://{BLOCKED}ander.com/wp-content/plugins/wp-db-backup-made/b.php?{random letter}={random values}
http://{BLOCKED}igital.com/wp-content/themes/twentytwelve/c.php?{random letter}={random values}
http://{BLOCKED}100unity.com/wp-includes/js/tinymce/skins/wordpress/images/e.php?{random letter}={random values}
http://{BLOCKED}v.com/plugins/system/plg_system_rewrite/a.php?{random letter}={random values}
http://{BLOCKED}eloper.com/tmp/b.php?{random letter}={random values}
http://{BLOCKED}ebangalore.org/wp-content/themes/twentyeleven/d.php?{random letter}={random values}
http://{BLOCKED}scod.com/tmp/e.php?{random letter}={random values}
http://{BLOCKED}advances.com/wp-content/plugins/updraftplus/oc/guzzle/Guzzle/Service/Command/LocationVisitor/Request/a.php?{random letter}={random values}
http://{BLOCKED}rgical.com/plugins/system/plg_system_rewrite/b.php?{random letter}={random values}
http://{BLOCKED}rymexico.com/foro/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/Session/Storage/Handler/c.php?{random letter}={random values}
http://{BLOCKED}ebetterwe.com/wp-content/plugins/wp-antibot-standart/d.php?{random letter}={random values}
http://{BLOCKED}celets.ro/wp-content/themes/twentytwelve/e.php?{random letter}={random values}
http://{BLOCKED}aonline.com/plugins/system/plg_system_rewrite/a.php?{random letter}={random values}
http://{BLOCKED}vn/wp-content/themes/twentytwelve/b.php?{random letter}={random values}
http://{BLOCKED}roseville.org/wp-content/plugins/wp-antibot-standart/c.php?{random letter}={random values}
http://{BLOCKED}ie.de/wp-content/plugins/revslider/css/jui/new/images/d.php?{random letter}={random values}
http://{BLOCKED}c.com.pk/wp-content/plugins/wp-antibot-standart/e.php?{random letter}={random values}
http://{BLOCKED}o.de/plugins/system/plg_system_rewrite/a.php?{random letter}={random values}
http://{BLOCKED}ement.com/blog/wp-content/plugins/wp-antibot-standart3/b.php?{random letter}={random values}
http://{BLOCKED}ftball.com/wp-content/themes/sports-team-theme/includes/advanced-custom-fields/assets/inc/datepicker/images/c.php?{random letter}={random values}
http://{BLOCKED}rvisi.info.tr/wp-content/themes/twentytwelve/d.php?{random letter}={random values}
http://{BLOCKED}k.info/wp-content/uploads/e.php?{random letter}={random values}
http://{BLOCKED}ce.ru/wp-content/themes/dreamynight-10/a.php?{random letter}={random values}
http://{BLOCKED}bahadi.com/wp-content/uploads/b.php?{random letter}={random values}
http://{BLOCKED}lemaneslabardena.com/plugins/system/plg_system_rewrite/c.php?{random letter}={random values}
http://{BLOCKED}zworld.com/wp-content/plugins/wp-antibot-standart/d.php?{random letter}={random values}
http://{BLOCKED}op4men.com.br/wp-content/plugins/wp-antibot-standart/a.php?{random letter}={random values}
http://{BLOCKED}homesearch.com/wp-content/plugins/wp-antibot-standart/b.php?{random letter}={random values}
http://{BLOCKED}c.ro/wp-content/themes/twentytwelve/c.php?{random letter}={random values}
http://{BLOCKED}serwa.com/wp-content/plugins/wp-db-backup-made/a.php?{random letter}={random values}
http://{BLOCKED}b.es/wordpress/wp-content/plugins/wp-db-backup-made1/d.php?{random letter}={random values}
http://{BLOCKED}elry.com/il/wp-content/plugins/ninja-forms/includes/admin/pages/ninja-forms-settings/tabs/c.php?{random letter}={random values}
http://{BLOCKED}a.com/blog/wp-content/plugins/scribe/lib/history/views/meta-box/c.php?{random letter}={random values}
http://{BLOCKED}n.ru/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_gallery_display/templates/list/a.php?{random letter}={random values}
http://{BLOCKED}n.com/wp-content/themes/twentythirteen/e.php?{random letter}={random values}
http://{BLOCKED}es.com/wp-content/themes/twentyeleven/a.php?{random letter}={random values}
http://{BLOCKED}partman.hu/de/wp-content/plugins/wp-db-backup-made/e.php?{random letter}={random values}
http://{BLOCKED}eoyunlari.org/wp-content/themes/twentytwelve/b.php?{random letter}={random values}
http://{BLOCKED}magenes.com/wp-content/plugins/wp-mobile-edition/admin/includes/mobile_themes/mTheme-Unus/images/blue/a.php?{random letter}={random values}
http://{BLOCKED}on.com/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/smoothness/images/a.php?{random letter}={random values}

It encrypts files with the following extensions:

3dm
3ds
3fr
3g2
3gp
3pr
7z
ab4
accdb
accde
accdr
accdt
ach
acr
act
adb
ads
agdl
ai
ait
al
apj
arw
asf
asm
asp
asx
avi
awg
back
backup
backupdb
bak
bank
bay
bdb
bgt
bik
bkp
blend
bpw
c
cdf
cdr
cdr3
cdr4
cdr5
cdr6
cdrw
cdx
ce1
ce2
cer
cfp
cgm
cib
class
cls
cmt
cpi
cpp
cr2
craw
crt
crw
cs
csh
csl
csv
dac
db
db3
dbf
db-journal
dc2
dcr
dcs
ddd
ddoc
ddrw
dds
der
des
design
dgc
djvu
dng
doc
docm
docx
dot
dotm
dotx
drf
drw
dtd
dwg
dxb
dxf
dxg
eml
eps
erbsql
erf
exf
fdb
ffd
fff
fh
fhd
fla
flac
flv
fpx
fxg
gray
grey
gry
h
hbk
hpp
ibank
ibd
ibz
idx
iif
iiq
incpas
indd
java
jpe
jpeg
jpg
kc2
kdbx
kdc
key
kpdx
lua
m
m4v
max
mdb
mdc
mdf
mef
mfw
mmw
moneywell
mos
mov
mp3
mp4
mpg
mrw
msg
myd
nd
ndd
nef
nk2
nop
nrw
ns2
ns3
ns4
nsd
nsf
nsg
nsh
nwb
nx2
nxl
nyf
oab
obj
odb
odc
odf
odg
odm
odp
ods
odt
oil
orf
ost
otg
oth
otp
ots
ott
p12
p7b
p7c
pab
pages
pas
pat
pcd
pct
pdb
pdd
pdf
pef
pem
pfx
php
pl
plc
pot
potm
potx
ppam
pps
ppsm
ppsx
ppt
pptm
pptx
prf
ps
psafe3
psd
pspimage
pst
ptx
py
qba
qbb
qbm
qbr
qbw
qbx
qby
r3d
raf
rar
rat
raw
rdb
rm
rtf
rw2
rwl
rwz
s3db
sas7bdat
say
sd0
sda
sdf
sldm
sldx
sql
sqlite
sqlite3
sqlitedb
sr2
srf
srt
srw
st4
st5
st6
st7
st8
std
sti
stw
stx
svg
swf
sxc
sxd
sxg
sxi
sxi
sxm
sxw
tex
tga
thm
tlg
txt
vob
wallet
wav
wb2
wmv
wpd
wps
x11
x3f
xis
xla
xlam
xlk
xlm
xlr
xls
xlsb
xlsm
xlsx
xlt
xltm
xltx
xlw
ycbcra
yuv
zip

It deletes the initially executed copy of itself

NOTES:

It searches all drives excluding the CD-ROM drive for files to encrypt.

It avoids encrypting files inside the following directories:

windows
temp
.
..
cache
Y@Cs
uvOyR
nvidia
games
packages

It deletes shadow copies by executing the following command:

vssadmin.exe Delete Shadows /All /Quiet

It drops HELP_DECRYPT.HTML, HELP_DECRYPT.PNG, HELP_DECRYPT.TXT, and HELP_DECRYPT.URL to all folders where files are encrypted.

It opens the dropped ransom notes HELP_DECRYPT.TXT, HELP_DECRYPT.PNG, and HELP_DECRYPT.HTML:

It demands payment for using the decryption service:

Minimum Scan Engine: 9.750

FIRST VSAPI PATTERN FILE: 11.864.05

FIRST VSAPI PATTERN DATE: 19 Aug 2015

VSAPI OPR PATTERN File: 11.865.00

VSAPI OPR PATTERN Date: 20 Aug 2015

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {random 7 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- {random 8 characters} = "%Application Data%\{random 8 characters}.exe"
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- *{random 6 characters} = "%System Root%\{random 8 characters}\{random 8 characters}.exe" (for Windows Vista and above only)
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- *{random 7 characters} = "%Application Data%\{random 8 characters}.exe" (for Windows Vista and above only)

Step 5

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry. Before you could do this, you must restart in Safe Mode. For instructions on how to do this, you may refer to this page If the preceding step requires you to restart in safe mode, you may proceed to edit the system registry.

In HKEY_CURRENT_USER\Software
- {UID}

Step 6

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
- From: DisableSR = "1"
  To: DisableSR = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
- From: Start = "4"
  To: Start = 2
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
- From: Start = "4"
  To: Start = 2
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS
- From: Start = "4"
  To: Start = 2
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
- From: Start = "4"
  To: Start = 2

Step 7

Search and delete this file

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

HELP_DECRYPT.HTML
HELP_DECRYPT.PNG
HELP_DECRYPT.TXT
HELP_DECRYPT.URL

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as RANSOM_CRYPWALL.CBQ157S. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 9

Reset your Desktop properties

[ Learn More ]

Step 10

Scan your computer with your Trend Micro product to delete files detected as RANSOM_CRYPWALL.CBQ157S. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters