Ransom.Win32.ICRYPT.AG

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system and executes them:

• {Legitimate file path}/{malware file}.exe <- it modifies the legitimate application to be its dropped copy.

Other Details

This Ransomware does the following:

• Execute the following command to take ownership of a file:
  • %System%\takeown.exe /F %System%\{legitimate file}.exe
  • %System%\icacls.exe %System%\{legitimate file}.exe /reset
• After encrypting file:
  • It restore/ delete the drop copy of itself and back to original legitimate file.
• It deletes itself after execution.
• Executes the following commands to gather information:
  • %System%\arp.exe -a
  • %System%\nslookup.exe {Infected Default Gateway}
  • %System%\nslookup.exe 225.255.255.255
  • %System%\nslookup.exe 239.255.255.250
  • %System%\net.exe view igmp.mcast.net
• Creates a process to execute the following command to delete the shadow copy of the infected system:
  • %System%\vssadmin.exe Delete Shadows /All /Quiet
• Executes the following commands:
  • %Application Data%\WXZuMM9D:bin %User Temp%\{Malware Filename}.exe
  • %System%\diskshadow.exe /s %User Temp%\{random character}.tmp <- script file containing diskshadow commands
  • %System%\diskshadow.exe /s %Windows%\TEMP\{random character}.tmp <- script file containing diskshadow commands

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It deletes itself after execution.

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• {All Drive}:\
• %Desktop%
• %Favorites%
• %Program Files%
• %ProgramData%
• %User Profile%
• %User Profile%\Documents
• %User Profile%\Downloads
• %User Profile%\Music
• %User Profile%\Pictures
• %User Profile%\Videos
• %User Profile%\Links
• %User Profile%\Contacts
• %User Profile%\Searches

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Favorites% is the current user's Favorites folder, which is usually C:\Documents and Settings\{user name}\Favorites on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Favorites on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It avoids encrypting files with the following strings in their file name:

• .exe
• .dll

It avoids encrypting files with the following strings in their file path:

• Windows
• Microsoft

It appends the following extension to the file name of the encrypted files:

• .0riz0n

It drops the following file(s) as ransom note:

• {encrypted file}.{file extension}.0riz0n_readme