RANSOM_RAA.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers information and reports it to its servers.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

• %My Documents%\{random 5 alphanumeric characters}.js
  (Note: %My Documents% is usually C:\\Documents and Settings\\{user name}\\My Documents on Windows 2000, XP, and Server 2003, or C:\\Users\\{user name}\\Documents on Windows Vista and 7.)

It drops the following files:

• %Desktop%\!!!README!!!{random 5 alphanumeric characters}.rtf-serves as ransom note
• %Desktop%\KEY-{GUID}-contains the key for decryption
• %My Documents%\doc_attached_{random 5 alphanumeric characters}-dummy file
• %My Documents%\{random 5 alphanumeric characters}.dll-non malicious component file(DynamicWrapperX)
• %My Documents%\ii.exe-detected by Trend Micro as TSPY_FAREIT.B
  (Note: %My Documents% is usually C:\Documents and Settings\{user name}\My Documents on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Documents on Windows Vista and 7.)

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• %System%\regsvr32.exe /i /s "%My Documents%\{random 5 alphanumeric characters}.dll"
• wordpad.exe "%My Documents%\doc_attached_{random 5 alphanumeric characters}"
• wordpad.exe "%Desktop%\!!!README!!!{random 5 alphanumeric characters}.rtf"
• %My Documents%\ii.exe
  (Note: %My Documents% is usually C:\Documents and Settings\{user name}\My Documents on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Documents on Windows Vista and 7.)

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
"" = "%My Documents%\{random 5 alphanumeric characters}.js argument"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\kkoq\Ghsgd

HKEY_CURRENT_USER\kkoq\kkoq-fnl

It adds the following registry entries:

HKEY_CURRENT_USER\kkoq\Ghsgd
"" = {GUID}

HKEY_CURRENT_USER\kkoq\kkoq-fnl
"" = "beenFinished"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\VSS

Other Details

This Trojan encrypts files with the following extensions:

• .doc
• .xls
• .rtf
• .pdf
• .dbf
• .jpg
• .dwg
• .cdr
• .psd
• .cd
• .mdb
• .png
• .lcd
• .zip
• .rar

It renames encrypted files using the following names:

• {filename of encrypted file}.{extension of encrypted file}.locked

It does the following:

• It avoids encrypting the following folders:
  • RECYCLER
  • Program Files
  • Program Files (x86)
  • Windows
  • Recycle.Bin
  • RECYCLE.BIN
  • Recycler
  • TEMP
  • APPDATA
  • AppData
  • Temp
  • ProgramData
  • Microsoft

It gathers the following information and reports it to its servers:

• http://bit.ly/{BLOCKED}MD

NOTES:

This ransomware opens the dropped document file containing a fake error message in Russian language stating that it requires a newer Word version to open the said document:

After its encryption routine, it opens the dropped ransom note: