Ransom.Win32.CRYPFINI.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %User Profile%\{Computer name}-{Random Characters}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• {Target Drive or Folders}:\ReadDecryptFilesHere.txt
• %User Profile%\z2.bmp

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\cmd.exe" /k vssadmin.exe Delete Shadows /All /Quiet
• "%System%\cmd.exe" /k bcedit.exe /set {default} recoveryenabled No
• "%System%\cmd.exe" /k bcedit.exe /set {default} bootstatuspolicy ignoreallfailures

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft corporation = %User Profile%\{Computer name}-{Random Characters}.exe

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
KEY = [Random characters]

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
KEYFREE = [Random characters]

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
1 = 000000

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
c = 23

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
m = 59

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
s = {59,43,41,39}

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
Finish = True

HKEY_CURRENT_USER\Software\CryptInfinite\
Info
FreeFile = {File name of the 10th encrypted file}

HKEY_CURRENT_USER\Software\CryptInfinite\
Files
{Number starting from 1 up to the total number of encrypted files} = {File name of the encrypted file}

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
wallpaper = %User Profile%\z2.bmp

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• msconfig.exe
• rstrui.exe
• tcpview.exe
• procexp.exe
• procmon.exe
• wireshark.exe
• lordPE.exe
• regedit.exe
• cmd.exe
• filemon.exe
• procexp64.exe

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\CryptInfinite

HKEY_CURRENT_USER\Software\CryptInfinite\
Info

HKEY_CURRENT_USER\Software\CryptInfinite\
Files

It does the following:

• Encrypts files within the following drives only:
  • Fixed Drive
  • Removable Drive
  • Network Drive
• Change desktop wallpaper into:
  
• Drops this text file that serves as a ransom note:
  
• Connects to the following URL and waits for a response before the malware proceeds to display the ransomnote:
  • http://{BLOCKED}i2.onion.direct/lending/bot.php?name={Computer Name}&kod={Random Characters}&pid=2
• Display this following window if successfully established connection from the URL above:
  • 
  • These buttons does the following:
    • "Next->" -> Display another page:
      
    • "Where buy?" -> https://www.paypal-cash.com -> Legitimate Paypal website.
    • "Decrypt 1 file for free" -> Restore the 10th encrypted file.
    • "Manual Check" -> Display another message and button:
      
    • "Download DecryptMax.exe" -> http://www.sendspace.com/file/{BLOCKED}n

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .yuv
• .php
• .html
• .jsp
• .xlsx
• .xlsm
• .xlsb
• .XLS
• .xlr
• .XLK
• .X3F
• .wps
• .wpd
• .wmv
• .wma
• .WB2
• .wav
• .vob
• .vmxf
• .vmx
• .vmsd
• .vmdk
• .vhdx
• .vhd
• .vdi
• .vbox
• .tlg
• .thm
• .tga
• .tex
• .swf
• .svg
• .stm
• .srw
• .srt
• .SRF
• .SR2
• .sql
• .sav
• .safe
• .rwl
• .rw2
• .rvt
• .rtf
• .rm
• .RAW
• .raf
• .R3D
• .qed
• .qcow2
• .qcow
• .qby
• .qbx
• .qbw
• .qbr
• .qbm
• .qbb
• .qba
• .py
• .pwm
• .PTX
• .pst
• .PSD
• .ps
• .pptx
• .PPTM
• .ppt
• .pps
• .png
• .pl
• .pif
• .pfx
• .pem
• .PEF
• .pdf
• .PDD
• .pdb
• .pct
• .pas
• .pab
• .P7C
• .p7b
• .p12
• .ost
• .orf
• .ogg
• .odt
• .ods
• .ODP
• .odm
• .odc
• .ODB
• .obj
• .oab
• .nvram
• .nrw
• .nk2
• .nef
• .ndf
• .nd
• .msg
• .MRW
• .mpg
• .mpeg
• .mp4
• .mp3
• .mov
• .mkv
• .MEF
• .mdf
• .mdb
• .max
• .m4v
• .m4p
• .m2ts
• .m
• .lua
• .log
• .kwm
• .key
• .kdc
• .jpg
• .JPEG
• .jpe
• .java
• .INDD
• .iif
• .hpp
• .hdd
• .h
• .groups
• .gif
• .flvv
• .flac
• .fla
• .ERF
• .eps
• .eml
• .edb
• .dxg
• .DXF
• .dwg
• .dtd
• .DOCX
• .docm
• .doc
• .DNG
• .dit
• .des
• .DER
• .dds
• .dcr
• .DBF
• .db
• .dat
• .cs
• .crw
• .crt
• .cr2
• .cpp
• .cer
• .cdr
• .c
• .blend
• .bin
• .BAY
• .bak
• .backup
• .back
• .avi
• .asx
• .asf
• .arw
• .aiff
• .ai
• .ach
• .ACCDB
• .7z
• .3gp
• .3g2
• .3fr
• .3ds
• .3dm

It avoids encrypting files found in the following folders:

• %Program Files%
• %Windows%

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .crinf