CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in 2018, built with the AutoIt scripting language, which primarily spreads through phishing emails. 

Unlike most ransomware, CryptoWire reportedly includes the decryption key within its code, while recovering encrypted files likely requires a complex process. 

Main Features:

The ransomware installs itself in a common location (“C:\Program Files\Common Files”) to ensure persistence, schedules tasks to maintain its presence on the system, and then scans the local network and connected devices to encrypt files, potentially compromising the entire network. 

Encrypted files are renamed with the “.encrypted” extension, and a log file named “domaincheck.txt” is saved on the desktop, possibly containing compromised system information. 

According to ASEC, the malware emptied the recycle bin and deleted shadow copies to hinder data recovery. Finally, a ransom message is displayed, demanding payment for decryption. 

Ransomware can include the decryption key within itself or send it along with stolen system information to the attacker’s server.

This method is uncommon, as most ransomware forces users through a complex decryption process to regain access to their files. 

To avoid infection, users should exercise caution when opening unknown files and utilize up-to-date anti-malware software to scan suspicious files. 

The system has been infected with multiple threats as a Trojan downloader (Trojan/Win.Kryptik.C5576563) was detected on January 20th, 2024, which could have downloaded other malware. 

More recently, on February 20th, 2024, ransomware (Ransomware/Win.bcdedit.C5590639) was also found, which likely encrypts files and demands a ransom for decryption.

Malware behavior consistent with ransomware execution (MDP.Ransom.M1171) was additionally detected. 

An analysis of the Indicators of Compromise (IoCs) revealed two MD5 hashes (cd4a0b371cd7dc9dab6b442b0583550c and a410d4535409a379fbda5bb5c32f6c9c) that could be used to identify malicious files.

A C2 server address (hxxp://194.156.98[.]51/bot/log.php) was found to likely communicate with the malware to receive instructions or send stolen data, as immediate action is required to remove this malware and protect the system.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.