Win32/Dircrypt

Installation

Win32/Dircrypt can spread via spam emails, or by being downloaded by other malware. It can drop a few copies of itself into these folders using random file names:

• %ProgramFiles% \<random folder name>
• %APPDATA% \<random folder>
• <startup folder>
• %TEMP%

For example:

• %ProgramFiles% \gnucleus\brcduejm.exe
• %APPDATA% \adobe\ankiybii.exe
• <startup folder> \msnrurfv.exe
• %TEMP% \iazkodqn.exe

It can also drop other files in your PC as part of its installation process:

• %APPDATA% \dirty\alertwall.jpg - the ransom note, which might look like this:
  
• %APPDATA% \dirty\dirtydecrypt.exe - which might be detected as Ransom:Win32/Dircrypt.A or Ransom:Win32/Dircrypt.B
• %APPDATA% \dirty\dirtydecrypt.exe
• %LOCALAPPDATA% \dirty\dirtydecrypt.exe

This threat also creates the following registry changes to that it runs automatically every time Windows starts:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<random value name>"
With data: "%APPDATA%\<random folder>\<malware file name>.exe"

In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "Userinit"
With data: "<system folder>\userinit.exe,,%ProgramFiles%\<random folder name>\<malware file name>.exe"

It also makes these registry changes as part of its installation process:

In subkey: HKLM\SAM\SAM\DOMAINS\Account\Users\000003EB
Sets value: "F"
With data: "<binary data>"

In subkey: HKLM\SAM\SAM\DOMAINS\Builtin\Aliases\00000220
Sets value: "C"
With data: "<binary data>"

In subkey: HKLM\SAM\SAM\Domains\Builtin
Sets value: "F"
With data: "<binary data>"

In subkeys: HKCU\Software\{<random GUID>} and HKLM\Software\{<random GUID>}
Sets value: "PeriodDisabed"
With data: "1"

This threat injects itself into these legitimate processes:

• explorer.exe
• svchost.exe
• winlogon.exe

Payload

Lowers security settings

It makes your PC less secure by changing these settings:

Bypasses the proxy server, if you have one configured:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Sets value: "ProxyBypass"
With data: "1"

Disables notifications about Windows Firewall:
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Sets value: "DisableNotifications"
With data: "1"

Disables the Security Center service:
In subkey: HKLM\SYSTEM\ControlSet001\Services\wscsvc
Sets value: "Start"
With data: "4"

Disables the Windows Update service:
In subkey: HKLM\SYSTEM\ControlSet001\Services\wuauserv
Sets value: "Start"
With data: "4"

Disables the Security Center warning that you don't have an antivirus program installed:
In subkey: HKLM\SOFTWARE\Microsoft\Security Center
Sets value: "AntiVirusOverride"
With data: "1"

Disables Task Manager:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
Sets value: "DisableTaskMgr"
With data: "1"

Disables Least user access (or LUA):
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system
Sets value: "EnableLUA"
With data: "0"

Encrypts files in your PC

This threat encrypts files in your PC. It then displays its dropped image to tell you how to recover your files by paying a ransom:

It encrypts files with the following extensions (but does not rename the extensions, so you may not be aware the file has been encrypted until you open it):

• .7z
• .avi
• .doc
• .doc
• .docx
• .jpeg
• .jpg
• .mpeg
• .mpg
• .pdf
• .png
• .rar
• .rtf
• .wmv
• .xls
• .xlsm
• .xlsx
• .zip

Analysis by Marianne Mallen