Analysis by: Nikko Tamana
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Ransomware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It enables its automatic execution at every system startup by dropping copies of itself into the Windows Common Startup folder.

It is capable of encrypting files in the affected system.

  TECHNICAL DETAILS

File Size: 126464 bytes
Memory Resident: Yes
Initial Samples Received Date: 13 Jan 2018

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKLM\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware file name}.exe = {malware file path}

It enables its automatic execution at every system startup by dropping the following copies of itself into the Windows Common Startup folder:

  • %Start Menu%\Programs\Startup\{malware file name}.exe
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\{malware file name}.exe

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Ransomware is capable of encrypting files in the affected system.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

  • .id-8AA7DEE7.[decrypthelp@qq.com].java