RANSOM_CRYPDNC.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %All Users Profile%\A.txt - list of encrypted files
• %All Users Profile%\A2.txt - list of encrypted files
• {folder of encrypted files}\HOW TO DECODE FILES!!!.txt - ransom note
• {folder of encrypted files}\КАК РАСШИФРОВАТЬ ФАЙЛЫ!!! - ransom note in russian language
• %User Temp%\~.bat - delete itself and shutdown the infected machine after 1 minute

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Ransomware renames encrypted files using the following names:

• {original filename and extension}.id-7ES642406.cry

It does the following:

• It executes the following commands:
  • cmd.exe /c %System%\icacls.exe "c:\System Volume Information" /grant {username}:F
  • cmd.exe /c %System%\icacls.exe "c:\System Volume Information" /remove {username}
  • cmd.exe /c %System%\icacls.exe "d:\System Volume Information" /grant {username}:F
  • cmd.exe /c %System%\icacls.exe "d:\System Volume Information" /remove {username}
• It also encrypts files with file size greater than 1,800,000 bytes and does not have any of the following extensions:
  • .cry
  • .dll
  • .iso
  • .tmp
  • .ypt
• It encrypts files with file size greater than 9000 bytes and has any of the following extensions:
  • .1cd
  • .3dp
  • .3gp
  • .7z
  • .abk
  • .abs
  • .accdb
  • .as
  • .ate
  • .avi
  • .bac
  • .backu
  • .bak
  • .bin
  • .bkc
  • .bkf
  • .bkp
  • .bls
  • .bpn
  • .c
  • .cab
  • .cbk
  • .cbu
  • .cdd
  • .cdr
  • .cdw
  • .cdx
  • .cer
  • .cf
  • .cfu
  • .cgm
  • .ck9
  • .cmx
  • .cpp
  • .cpt
  • .cs
  • .csr
  • .csv
  • .dat
  • .db
  • .db2
  • .db3
  • .dba
  • .dbc
  • .dbf
  • .dbk
  • .dbs
  • .dbt
  • .dbv
  • .dbx
  • .dcb
  • .dd
  • .ddl
  • .dds
  • .df1
  • .dgn
  • .dmo
  • .doc
  • .docm
  • .docx
  • .dp1
  • .dt
  • .dwg
  • .dxf
  • .dxl
  • .eap
  • .eco
  • .edb
  • .emd
  • .eml
  • .epf
  • .eps
  • .eql
  • .erf
  • .ert
  • .ext
  • .fbf
  • .fbu
  • .fcd
  • .fh
  • .flb
  • .flkb
  • .frf
  • .frm
  • .frm
  • .frx
  • .gdb
  • .gpx
  • .gzip
  • .hdr
  • .htm
  • .html
  • .igs
  • .java
  • .jpeg
  • .jpg
  • .jse
  • .json
  • .jsp
  • .key
  • .ldf
  • .mac
  • .md
  • .mdb
  • .mdf
  • .mdx
  • .mft
  • .mp4
  • .mpeg
  • .msf
  • .msg
  • .mxl
  • .myd
  • .myi
  • .nam
  • .nb7
  • .nbd
  • .nbk
  • .nbs
  • .ncb
  • .nch
  • .ndoc
  • .nofiles
  • .npf
  • .ns2
  • .ns3
  • .ns4
  • .nyf
  • .obkp
  • .ods
  • .odt
  • .old
  • .one
  • .ora
  • .pan
  • .pas
  • .pdb
  • .pdf
  • .pdm
  • .pdn
  • .phm
  • .pl
  • .png
  • .pps
  • .ppsm
  • .ppt
  • .pptm
  • .pptx
  • .ps
  • .psd
  • .pst
  • .py
  • .rar
  • .ref
  • .reg
  • .rsd
  • .rtf
  • .sai
  • .sbb
  • .sbf
  • .sdb
  • .sdf
  • .sqb
  • .sql
  • .sqlite
  • .sqlite3
  • .sqlitedb
  • .svg
  • .tar
  • .tbb
  • .tbn
  • .tdt
  • .te
  • .tib
  • .txt
  • .uci
  • .udb
  • .usr
  • .vbe
  • .vbp
  • .vbs
  • .vbx
  • .vhd
  • .vmdk
  • .vrp
  • .xds
  • .xld
  • .xls
  • .xlsm
  • .xlsx
  • .xml
  • .zip
• It executes the following commands to stop services:
  • net stop "MSSQLSERVER" /y
  • net stop "MSSQL$SQL" /y
  • net stop "MSSQL$SQLEXPRESS" /y
  • net stop "postgresql-x64-9.6" /y
  • net stop "Schedule" /y
  • net stop "RKeeperMidServer" /y
  • net stop "RKeeperRepServer" /y
  • net stop "SDBSERV" /y
  • net stop "SQLWriter" /y
  • net stop "TeamViewer" /y
  • net stop "hMailServer" /y
  • net stop "MySQL" /y
  • net stop "MSSQL$S15292784" /y
  • net stop "SQLBrowser" /y
  • net stop "FileZilla Server" /y
  • net stop "RServer3" /y
  • net stop "afcdpsrv" /y
  • net stop "syncagentsrv" /y
  • net stop "C__UCS_CARDSERV_CARDSERV" /y
  • net stop "Sdbserv 192.168.0.18" /y
  • net stop "tvnserver" /y
  • net stop "SrvSgr030" /y
  • net stop "GbpSv" /y
  • net stop "uvnc_service" /y
  • net stop "MSSQL$MEGASUL" /y
  • net stop "fbguard" /y
  • net stop "fbserver" /y
  • net stop "D_RK6CARDSERV_CARDSERV" /y
  • net stop "acrSch2Svr" /y
  • net stop "acrSch2Svr" /y

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:

The ransom notes contains the following: