CryptoShield 1.0 Ransomware

A new CryptoMix, or CrypMix, variant called CryptoShield 1.0 Ransomware has been discovered. The infected files may be sent out via a variety of e-mail templates which may be spammed to the victim, claiming they are containing an invoice or other important document that has to be opened. Usually, most inexperienced users tend to open the attachments.

After the malicious attachment is opened, the virus gets right down to business. It may create multiple malicious files, also known as modules and each of those files is responsible for different activities. The files may be dropped under different names in the following Windows folders: Appdata, temp, Roaming, user profile, common and system 32. File names could be notepad.exe, setup.exe, patch.exe, update.exe, software-update.exe, svchost.exe etc.

After dropping the files, the CryptoShield 1.0 virus may create registry entries regval and regdata in these key locations:

HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run or RunOnce

When CryptoShield starts encrypting files using AES-256 encryption, encrypt the filename using ROT-13, and then append the .CRYPTOSHIELD extension to the encrypted file. For example, a file called test.jpg would be encrypted and renamed as grfg.wct.CRYPTOSHIELD. You can decrypt the filenames by using any ROT-13 encryptor, such as rot13.com.

In each folder that CryptoShield encrypts a file, it will also create ransom notes named # RESTORING FILES #.HTML and # RESTORING FILES #.TXT.

During this process, the ransomware will issue the following commands to disable the Windows startup recovery and to clear the Windows Shadow Volume Copies as shown below.

cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe” /C vssadmin.exe Delete Shadows /All /Quiet
“C:\Windows\System32\cmd.exe” /C net stop vss

CryptoShield will then display a fake alert stating that there was an application error in Explorer.exe. Though, you can see spelling mistakes such as “momory” and an odd request that you should click on the Yes button in the next Window “for restore work explorer.exe”. Once you press OK on the above prompt, you will be presented with a User Account Control prompt, which asks if you wish to allow the command “C:\Windows\SysWOW64\wbem\WMIC.exe” process call create “C:\Users\User\SmartScreen.exe” to execute. This explains why the previous alert was being shown; to convince a victim that they should click on the Yes button in the below UAC prompt.

crypto

File Associated with the CryptoShield CrypMix Variant:
C:\ProgramData\MicroSoftWare\
C:\ProgramData\MicroSoftWare\SmartScreen\
C:\ProgramData\MicroSoftWare\SmartScreen\SmartScreen.exe
%AppData%\Roaming\1FAAXB2.tmp
[encrypted_file_name].CRYPTOSHIELD
# RESTORING FILES #.HTML
# RESTORING FILES #.TXT
Registry Entries Associated with the CryptoShield CrypMix Variant:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Windows SmartScreen” = “C:\ProgramData\MicroSoftWare\SmartScreen\SmartScreen.exe”

Kepp a good Anti Virus such as Max Total Security installed and update daily and scan once a day to keep from Malware.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>