Ransom.Win32.ZEPPELIN.K

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\{Random Characters}.zeppelin
• %User Temp%\~{Random Characters}.bat → responsible for deleting shadow copies

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following copies of itself into the affected system:

• %Application Data%\Microsoft\Windows\{Random name of any running process}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\cmd.exe" /C %User Temp%\~{Random Characters}.bat
• "%System%\cmd.exe" /C wmic shadowcopy delete
• "%System%\cmd.exe" /C bcdedit /set {default} recoveryenabled no
• "%System%\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /C wbadmin delete catalog -quiet
• "%System%\cmd.exe" /C vssadmin delete shadows /all /quiet
• "%Application Data%\Microsoft\Windows\{Random name of any running process}.exe" -agent {Corresponding number of Drive from HKEY_CURRENT_USER\Software\Zeppelin\Paths}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It executes then deletes itself afterward.

It injects codes into the following process(es):

• %System%\notepad.exe → for deleting itself

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Same filename from the dropped copy on %Application Data%\Microsoft\Windows} = "%Application Data%\Microsoft\Windows\{Random name of any running process}.exe" -start

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Zeppelin
Process = {Random Characters}

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
{A numerical value starting from 0 that increments for each logical drives found} = {Corresponding Drive Letter}

• Note: The number of registry entries created depends on the number of logical drives found

HKEY_CURRENT_USER\Software\Zeppelin\
Log
{Corresponding value of Drive Letter from HKEY_CURRENT_USER\Software\Zeppelin\Paths registry key} = {Number of encrypted files} | {Path}

Process Termination

This Ransomware terminates the following services if found on the affected system:

• agntsvc.exe
• anvir.exe
• anvir64.exe
• apache.exe
• backup.exe
• ccleaner.exe
• ccleaner64.exe
• dbeng50.exe
• dbsnmp.exe
• encsvc.exe
• far.exe
• firefoxconfig.exe
• infopath.exe
• isqlplussvc.exe
• kingdee.exe
• msaccess.exe
• msftesql.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld-nt.exe
• mysqld-opt.exe
• mysqld.exe
• ncsvc.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• oracle.exe
• procexp.exe
• regedit.exe
• sqbcoreservice.exe
• sql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlserver.exe
• sqlservr.exe
• sqlwriter.exe
• synctime.exe
• taskkill.exe
• tbirdconfig.exe
• tomcat.exe
• tomcat6.exe
• u8.exe
• ufida.exe
• visio.exe
• xfssvccon.exe

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\Zeppelin

HKEY_CURRENT_USER\Software\Zeppelin\
Paths

HKEY_CURRENT_USER\Software\Zeppelin\
Log

It does the following:

• It terminates itself if found to be running in a machine from the following countries:
  
  • Ukraine
  • Belorussia
  • Kazakhstan
  • Russian Federation

It accepts the following parameters:

• {Path of the file to encrypt}
• {Path of the directory to encrypt}
• -start (file encryption mode only)
• -agent {Corresponding Drive number from HKEY_CURRENT_USER\Software\Zeppelin\Paths registry key}

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• boot.ini
• bootfont.bin
• bootsect.bak
• desktop.ini
• iconcache.db
• ntdetect.com
• ntldr
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db
• !!! all your files are encrypted !!!.txt

It avoids encrypting files found in the following folders:

• :\$Windows.~bt\
• :\System Volume Information\
• :\Windows.old\
• :\Windows\
• :\intel\
• :\nvidia\
• :\inetpub\logs\
• \All Users\
• \AppData\
• \Apple Computer\Safari\
• \Application Data\
• \Boot\
• \Google\
• \Google\Chrome\
• \Mozilla Firefox\
• \Mozilla\
• \Opera Software\
• \Opera\
• \Tor Browser\
• \Common Files\
• \Internet Explorer\
• \Windows Defender\
• \Windows Mail\
• \Windows Media Player\
• \Windows Multimedia Platform\
• \WindowsNT\
• \Windows Photo Viewer\
• \Windows Portable Devices\
• \WindowsPowerShell\
• \Windows Photo Viewer\
• \Windows Security\
• \Embedded Lockdown Manager\
• \Windows Journal\
• \MSBuild\
• \Reference Assemblies\
• \Windows Sidebar\
• \Windows Defender AdvancedThreat Protection\
• \Microsoft\
• \Package Cache\
• \Microsoft Help\

It appends the following extension to the file name of the encrypted files:

• {Original Filename}.{Original File Extension}.{Unique ID}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
  

It avoids encrypting files with the following file extensions:

• .hta
• .bat
• .cmd
• .com
• .cpl
• .dll
• .msc
• .msp
• .pif
• .scr
• .sys
• .log
• .lnk