Analysis by: Kiyoshi Obuchi
ALIASES:

Trojan:Win32/Gandcrab.AF (Microsoft); W32/Kryptik.GJYS!tr (Fortinet)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Ransomware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

  TECHNICAL DETAILS

File Size: 999,424 bytes
File Type: EXE
Initial Samples Received Date: 21 Aug 2018

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

  • %ProgramData%\WrdJdgYRmg\winsrvc32.exe

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData in Windows Vista, 7, and 8.)

It drops the following files:

  • %ProgramData%\WrdJdgYRmg\cfgi
  • %ProgramData%\WrdJdgYRmg\cfg

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData in Windows Vista, 7, and 8.)

It adds the following processes:

  • %System%wuapp.exe -c "%Program Data%\WrdJdgYRmg\cfg"

It creates the following folders:

  • %ProgramData%\WrdJdgYRmg

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData in Windows Vista, 7, and 8.)

Autostart Technique

This Ransomware drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

  • %User Startup%\BfWTjSzBAA.url

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other Details

This Ransomware connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}.197.60/new.txt

However, as of this writing, the said sites are inaccessible.