Ransom.Win32.NOESCAPE.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes files in certain folders, disabling programs and applications from properly running.

It adds accounts to have an administrator privilege. This allows the malware or a malicious user to perform tasks that may put the affected system in greater risk.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• Used to change default account picture:
  • %ProgramData%\Microsoft\User Account Pictures\user.bmp
  • %ProgramData%\Microsoft\User Account Pictures\user.png
  • %ProgramData%\Microsoft\User Account Pictures\user-32.png
  • %ProgramData%\Microsoft\User Account Pictures\user-40.png
  • %ProgramData%\Microsoft\User Account Pictures\user-48.png
  • %ProgramData%\Microsoft\User Account Pictures\user-192.png
• Used to change desktop wallpaper
  • %AppDataLocal%\noescape.png

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following copies of itself into the affected system:

• %Windows%\winnt32.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• %System%\notepad.exe
• %System%\cmd.exe
• %System%\mspaint.exe
• %System%\taskmgr.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• processLimit
• processLimitPayLoad

It modifies file attributes to make files hidden.

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = %System%\userinit.exe,%Windows%\winnt32.exe → to execute malware copy during Windows logon

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile\shell\open\
command
(Default) = %Windows%\winnt32.exe "%1" %* → if malware copy is existing

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile\shell\runas\
command
(Default) = %Windows%\winnt32.exe "%1" %* → if malware copy is existing

Other System Modifications

This Ransomware deletes files in the following folders:

• %ProgramData%\Microsoft\User Account Pictures
• %Desktop%
• %Public%\Desktop

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoAdminLogon = 1 → enable automatic logon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DisableCAD = 1 → disable Secure Attention Sequence

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
shutdownwithoutlogon = 0 → disable the shutdown button in the log on to Windows dialog box

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
UseDefaultTile = 1 → apply the default account picture to all users

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableLogonBackgroundImage = 1 → disable sign-in background image

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Keyboard Layout
Scancode Map = → disable selected keyboard keys

HKEY_CURRENT_USER\Control Panel\Mouse
SwapMouseButtons = 1 → swap mouse buttons

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = 0 → disables User Account Control (UAC)

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = 1 → disables Windows registry editors

HKEY_CURRENT_USER\SOFTWARE\Policies\
Microsoft\Windows\System
DisableCMD = 2 → disable command line

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoRestartShell = 0 → disables rebooting of explorer.exe

HKEY_CURRENT_USER\Control Panel\Desktop
AutoColorization = 1 → automatically pick an accent color from desktop background

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Shell\Bags\1\
Desktop
FFLags = → to randomly rearrange desktop icons

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
NoEscape
ShowWindow =

It sets the system's desktop wallpaper to the following image:

• %AppDataLocal%\noescape.png
  

Other Details

This Ransomware adds the following accounts to the Administrator group:

• NO ESCAPE

It does the following:

• It only proceeds to its encryption routine if it is executed in a Windows NT 10.0 OS.
  • It prompts the following message box if not executed in a Windows NT 10.0 OS.
  
  
• It prompts the following message box before encryption:
  
• It adds user accounts with random usernames.
• It adds user accounts to the following local groups:
  • Administrators
  • Users
• It changes the user name to the following:
  • NO ESCAPE
• It changes the user password to the following:
  • death
• If the malware copy is existing:
  • It displays the following window:
    
  • It terminates itself if window is closed.
  • It stretches the bitmap of the desktop and running windows.
• It prompts the following message box when executable files are opened:
  
• It terminates explorer.exe to hide taskbar.
• It randomly rearranges desktop icons.
• It blocks user input.
• It controls the system's keyboard activity to type the following on notepad.exe:
  
  • It waits for the user to enter 'yes' on notepad and then proceeds on opening the following processes:
  • %System%\cmd.exe
  • %System%\mspaint.exe
  • %System%\taskmgr.exe
• It enables automatic logon.
• It disables Ctrl+Alt+Delete keystroke combination.
• It disables the shutdown button in the log on to Windows dialog box.
• It changes the default account picture to the following images:
  
• It disables sign-in background image.
• It enables selected keyboard keys.
• It swaps mouse buttons.
• It disables User Account Control (UAC).
• It disables Windows registry editors.
• It disables command line.
• It disables rebooting of explorer.exe.
• It automatically picks an accent color from desktop background
• It executes malware copy during Windows logon.
• It deletes itself after execution.
• It restarts the machine after execution.
• It prompts the following message box when executable files are opened:
  

Ransomware Routine

This Ransomware drops the following file(s) as ransom note:

• %Public%\Desktop\{random} → multiple copies