Alerting to all Windows users of a new type of a Self-propagating ransomware that exhibits worm-like behavior to propagate itself.

Microsoft is alerting all Windows users of a new type of ransomware that exhibits worm-like behavior.

“We are alerting Windows users of a new type of ransomware that exhibits worm-like behavior. This ransom leverages removable and network drives to propagate itself and affect more users. We detect this ransomware as Ransom:Win32/ZCryptor.A.”  states Microsoft,

The Infection vector

Ransom:Win32/ZCryptor.A is spread through the spam email infection vector. It runs at start-up as soon as ZCryptor is executed.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

zcrypt = {path of the executed malware}

In the start-up folder it drops zycrypt.lnk and autorun.inf in removable drives:

%User Startup%\zcrypt.lnk

It also changes the file attributes to be in Stealth mode from the user, also it makes a copy of itself as {Drive}:\system.exe and %APPDATA%\zcrypt.exe

For Example:  c:\users\administrator\appdata\roaming\zcrypt.exe

The Payload

It then displays the ransom note to users in an HTML file How to decrypt files.html

Later it encrypts files in your disk and then will change the file extension to .zcrypt (Eg. <originalfilename.zcrypt>)

Infected machines are observed to have zcrypt1.0 mutex which denotes that an instance of this ransomware is already running on the infected machine.

The connection has also been observed to the following URL. But the domain is already down while testing

http://<obfuscated>/rsa/rsa.php?computerid={Computer_ID} where the {Computer_ID} is entry found inside a dropped file %APPDATA%\cid.ztxt

For example, c:\users\administrator\appdata\roaming\cid.ztxt

The warning issued by Microsoft also include information about Detection, Prevention, and Recovery from such kind of self-propagating ransomware