Ransom.Win32.CONTI.FAIL

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\IXP{3 Digit Number}.TMP\Convulsa.aif → Encoded Autoit Script
• %User Temp%\IXP{3 Digit Number}.TMP\Mantenere.mp3 → Encoded Batch Script
• %User Temp%\IXP{3 Digit Number}.TMP\Qua.vob → Encoded Conti Executable
• %User Temp%\IXP{3 Digit Number}.TMP\Seduce.pdf → Incomplete AutoIt.exe
• %User Temp%\IXP{3 Digit Number}.TMP\Pel.wks → Decoded Batch Script
• %User Temp%\IXP{3 Digit Number}.TMP\fontdrvhost.com → Fixed AutoIt.exe
• %User Temp%\IXP{3 Digit Number}.TMP\u → Decoded AutoIt Script
• {Malware Path}\{Filename from -log argument} → If -log argument is used

It adds the following processes:

• %System%\cmd.exe /c kWdQZqX
• %System%\cmd.exe /c certutil -decode Mantenere.mp3 Pel.wks & cmd < Pel.wks
• fontdrvhost.com
• findstr /V /R "^bvkNtqCXyvaCYObJkczHScDjeUGQ$" Seduce.pdf >> fontdrvhost.com
• certutil -decode Convulsa.aif u
• start fontdrvhost.com u
• ping 127.0.0.1 -n 30
• %User Temp%\IXP{3 Digit Number}.TMP\fontdrvhost.com
• %System%\cmd.exe /c %System%\wbem\WMIC.exe shadowcopy where "ID={Shadowcopy ID}" delete → It will repeat this process depending on the number of shadow copies.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• hsfjuukjzloqu28oajh727190

It injects codes into the following process(es):

• %User Temp%\IXP{3 Digit Number}.TMP\fontdrvhost.com

Other Details

This Ransomware does the following:

• It uses the Windows Restart Manager to unlock files it will encrypt.
• It checks the connection to the following Domain Names using the command ping -n {Domain Name} and will terminate if the connection was succesful:
  • {BLOCKED}VjZNprwTYLlzMTM.YcaRetVjZNprwTYLlzMTM
  • {BLOCKED}P.tKeDLKP

It terminates itself if any of the following computer name(s) are found in the affected system:

• DESKTOP-QO5QU33
• NfZtFbPfH
• ELICZ
• MAIN
• tz

It accepts the following parameters:

• -p {Path of Folder to Encrypt} - Will encrypt first the folders in the list before proceeding to the others
• -log {Log Filename with Path} - Log output to {Log Filename with Path}
• -nomutex - Creates no mutex allowing multiple process
• -m {all|local|net|backups}
  • all - combination of net and local
  • local - delete backups and encrypt only locally found drives
  • net - delete backups and encrypt only network shares
  • backups - delete backups
• -size {chunk mode}

It deletes the following files to remove its traces in the system:

• %User Temp%\IXP{3 Digit Number}.TMP\Convulsa.aif
• %User Temp%\IXP{3 Digit Number}.TMP\Mantenere.mp3
• %User Temp%\IXP{3 Digit Number}.TMP\Qua.vob
• %User Temp%\IXP{3 Digit Number}.TMP\Seduce.pdf
• %User Temp%\IXP{3 Digit Number}.TMP\Pel.wks
• %User Temp%\IXP{3 Digit Number}.TMP\u

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• readme.txt
• CONTI_LOG.txt

It avoids encrypting files with the following strings in their file path:

• tmp
• winnt
• temp
• thumb
• $Recycle.Bin
• $RECYCLE.BIN
• System Volume Information
• Boot
• Windows
• Trend Micro
• Perflogs

It appends the following extension to the file name of the encrypted files:

• .CVKVA

It drops the following file(s) as ransom note:

• {Encrypted Directory}\readme.txt
  

It avoids encrypting files with the following file extensions:

• .CVKVA
• .bat
• .exe
• .dll
• .lnk
• .sys
• .msi