New Ransomware Part 2

After spending a good bit of time getting the file unpacked (was packed using ASPACK encryption), I have gotten to a point where I can get a better idea of what it does.  The results, so far are not that encouraging for the possibility of recovering the .crypt files to a usable form.  Depending on if you have removed it or not, there may be some help.

First, this is what it looks like on the screen:

The process that is running is called: "SetSysLog32.exe"

Look in the registry for the key:

HKU\S-1-5-21-1659004503-1563985344-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\SetSysLog32: ""C:\Documents and Settings\Administrator\Application Data\SetSysLog32.exe""

If that is there, then this is most likely what you have.

If you look under the key:


HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\bdgid: "1lL2V9I3dqW0?y"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\id: "933"

Then you will notice that the entry under "id," (in this case it is "933") then you will find that this matches the number displayed at the top of the warning splash screen on boot-up.

The other entry, under "bgdid" may be the password needed to decrypt the encrypted files.

It would appear that the numbers that come back are being generated by the server located at the IP address that the malware sends the string "new" to right after unpacking and just as it initializes.  Unfortunately to this time, I have been unable to test that theory, as the only encrypted files that I have from a live machine had the ID number 313 at the top.

It does appear to be AES encryption, as the file has references to AesLib.dcu and EftGlobal.dcu inside of it once unpacked.  I also found those files in the temp directory of the originally infected machine.

More to come once I get the reports back from my sandbox and a few more runs though my lab.