Crypren Ransomware Analysis

Overview

In this article we analyze Crypren, a piece of malware which at first looks like a typical Ransomware by encrypting the victim’s document files and asking for a ransom, in Bitcoins (BTC), but with a little surprise. If the victim actually pays the ransom, no file is restored. Fair to say, Crypren turns to be more like a fraud than a Ransomware at the end.

Infection vector

The infection vector starts by downloading a ZIP file available in the, already removed, YouTube video: h t t p s : / / www.youtube(.)com/watch?v=X_gFoqhP99k. In the video description we can find a link pointing to a supposed SKIDROW’s crack for the “Enter the Gungeon” videogame. The link to the cracking tool was recently deleted but originally pointing to: h t t p : / / www.mediafire.com/download/430i2vh9h4hldfc/Enter_the_Gungeon_SKIDROW.zip.

Infection Analysis

Dropper

The ZIP file contains two files, one is the dropper and the other is a cURL library used for downloading the actual Ransomware binary.

The dropper’s main functionality is implemented by two functions. The first one downloads the Ransomware binary to the C:\ProgramData\krypt.exe folder. The second, adds a Registry launch point at Software\Microsoft\Windows\CurrentVersion for further persistence.

The Ransomware binary’s download URL points to: h t t p : / / www.qweasdzxc1425(.)cba(.)pl/x/k.exe .

PE Hash

PE Sections

Crypren

At the begining, the malware tries to enumerate all disk devices by scanning the mapped drive letters from B: to P: and leaving C: for the glorious end.

If a valid drive is found, a new thread is run to enumerate all the files with the following extensions:

'txt','jpg','png','xml','doc','docx','xls','xlsx','ppt','pptx','gif','bmp','sql','php','html','cs','cpp','docm','docb','rar','zip','xlm','py','mp3','mp4','xlsb','xla ','xlam ','xll ','xlw ','pdf','pps','pot','accdb','accde','accdt','accdr','cert','swf','mdb','rtf','gzip','tar','css'

Once the file enumeration is done, the malware generates a 64 bytes key to encrypt the files.

Then, it creates an HTML file with the user’s recovery instructions as follows.

Next, the file processing task continues by adding each matching file to a linked list for its later deletion, and creating a new file with the same name and extension as the original, but adding a second extension: .ENCRYPTED. The original file’s content is then encrypted with the key and stored in the newly created file.

Last step will delete the original files from the system.

Once the full encryption is completed, the malware will kindly ask to reboot the system, showing a welcoming Readme file on startup.

PE Hash

PE Sections

Conclusions

Perhaps not the most sophisticated Ransomware ever, to the analysis’ author it looks more like a Frankenstein copycat born from the StackOverflow forums. To note, the use of the same compiler vc++ 2010 and OpenSSL libraries in both components suggest the dropper and the Ransomware may come from the same actor.

Moreover, the encryption routine is far simple and can be further read about here: https://github.com/mlwre/DecryptCrypren/blob/master/README.md .