Ransom.Win32.SAFEPAY.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• "%System%\cmd.exe" /c vssadmin delete shadows /all /quiet
• "%System%\cmd.exe" /c wmic shadowcopy delete
• "%System%\cmd.exe" /c bcdedit / set{default} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /c bcdedit / set{default} recoveryenabled no

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• It uses either the default name from its configuration data or an ID generated from the -path= parameter:
  • Global\{Hardcoded ID from configuration data}
  • ID generated from the -path= parameter

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Generated ID} = {Malware command-line execution}

Propagation

This Ransomware does not have any propagation routine.

Backdoor Routine

This Ransomware does not have any backdoor routine.

Rootkit Capabilities

This Ransomware does not have rootkit capabilities.

Process Termination

This Ransomware terminates the following services if found on the affected system:

• vss
• sql
• svc$
• memtas
• mepocs
• msexchange
• sophos
• veeam
• backup
• GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr

It terminates the following processes if found running in the affected system's memory:

• sql
• oracle
• ocssd
• dbsnmp
• synctime
• agntsvc
• isqlplussvc
• xfssvccon
• mydesktopservice
• ocautoupds
• encsvc
• firefox
• tbirdconfig
• mydesktopqos
• ocomm
• dbeng50
• sqbcoreservice
• excel
• infopath
• msaccess
• mspub
• far
• onenote
• outlook
• powerpnt
• steam
• thebat
• thunderbird
• visio
• winword
• wordpad
• notepad
• wuauclt
• onedrive
• sqlmangr

Information Theft

This Ransomware does not have any information-stealing capability.

Other Details

This Ransomware does the following:

• It empties the recycle bin.

It accepts the following parameters:

• -uac → UAC Bypass flag
• -network → Encrypt shared resources
• -selfdelete → Self-deletion after execution
• -log → Enable logging, creates a log file located at %All Users Profile%\auto.log.safepay
• -netdrive → Encrypt network drives
• -pass={32 Characters} → Password for execution
• -path= → Path for files to encrypt
• -enc= → Encryption level

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It does not exploit any vulnerability.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .safepay
• .exe
• .dll
• .pdb
• .386
• .cmd
• .ani
• .adv
• .ps1
• .cab
• .msi
• .msp
• .com
• .nls
• .ocx
• .mpa
• .cpl
• .mod
• .hta
• .prf
• .rtp
• .rpd
• .bin
• .hlp
• .shs
• .drv
• .wpx
• .bat
• .rom
• .msc
• .spl
• .msu
• .ics
• .key
• .lnk
• .hlp
• .sys
• .drv
• .cur
• .idx
• .ldf
• .ini
• .reg
• .apk
• .ttf
• .otf
• .fon
• .fnt
• .dmp
• .tmp
• .pif
• .wav
• .wma
• .dmg
• .app
• .ipa
• .xex
• .wad
• .msu
• .icns
• .theme
• .diagcfg
• .diagcab
• .diagpkg
• .msstyles
• .gadget
• .woff
• .part
• .sfcache
• .winmd
• .icl
• .deskthemepack
• .nomedia

It avoids encrypting files with the following strings in their file name:

• readme_safepay.txt
• autorun.inf
• boot.ini
• bootfont.bin
• bootsect.bak
• desktop.ini
• iconcache.db
• ntldr
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db

It avoids encrypting files found in the following folders:

• $WinREAgent
• $Windows.~bt
• public
• config.msi
• intel
• msocache
• $recycle.bin
• $windows.~ws
• tor browser
• boot
• windows nt
• msbuild
• microsoft
• all users
• system volume information
• perflogs
• application data
• windows
• windows.old
• appdata
• common files
• windows defender
• windowsapp
• windowspowershell
• usoshared
• windows security
• program files
• program files (x86)
• programdata
• default
• mozilla firefox

It appends the following extension to the file name of the encrypted files:

• .safepay

It drops the following file(s) as ransom note:

• {Encrypted Directory}\readme_safepay.txt