{"id":2548,"date":"2016-07-25T14:07:10","date_gmt":"2016-07-25T07:07:10","guid":{"rendered":"https:\/\/humanit.asia\/?p=2548"},"modified":"2019-07-22T15:02:44","modified_gmt":"2019-07-22T08:02:44","slug":"zepto-ransomware-packed-into-wsf-spam","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/zepto-ransomware-packed-into-wsf-spam\/","title":{"rendered":"Zepto Ransomware Packed into WSF Spam"},"content":{"rendered":"
\n

ThreatTrack Labs has recently observed a surge of spam containing a zip attachment with a WSF (Windows Scripting File) to deliver Zepto ransomware. This tactic is a change from the common JavaScript and macro documents being spammed previously.<\/p>\n

Here are actual emails featuring familiar social engineering tactics:<\/p>\n

\"ransomware<\/a><\/p>\n

\"ransomware<\/a><\/p>\n

\"ransomware<\/a><\/p>\n

The zip attachments contain the WSF.<\/p>\n

\"infected<\/a><\/p>\n

An Interactive Analysis with ThreatAnalyzer<\/strong><\/p>\n

To see what we\u2019re dealing with, we turned to ThreatTrack\u2019s malware analysis sandbox<\/a> ThreatAnalyzer.<\/p>\n

We extracted the WSF, submitted it to ThreatAnalyzer and generated the following threat analysis:<\/p>\n

\"Zepto<\/a><\/p>\n

Since this is a script, we are more concerned with the call tree from WScript.exe. One notable result, encircled above, is the number of modified files. This most indicates a high likelihood that this could either be a virus or ransomware. And considering the proliferation of ransomware attacks lately, that\u2019s our biggest concern.<\/p>\n

There are two captured screen shots from our analysis.<\/p>\n

\"Zepto<\/a><\/p>\n

Expanding the MODIFIED FILES shows this result.<\/p>\n

\"ransomware<\/a><\/p>\n

The files affected are renamed with a \u201c.zepto\u201d filename extension.<\/p>\n

Given the screenshot and Modified Files artifacts, we can confidently say that this is a variant of the Zepto ransomware.<\/p>\n

The WSF Script Behavior<\/strong><\/p>\n

Selecting C:WindowsSystem32WScript.exe (3388)<\/em> shows results of the behaviors done by the WSF alone.<\/p>\n

\"ransomware<\/a><\/p>\n

\"ransomware<\/a><\/p>\n

It shows that the script created two files and made an HTTP connection to mercumaya.net<\/em>.<\/p>\n

Let\u2019s look at the two files in the Temp folder.<\/p>\n

This is the binary view of UL43Fok40ii<\/em> file<\/p>\n

\"Zepto<\/a><\/p>\n

This is the UL43Fok40ii.exe<\/em> file.  A complete PE file format.<\/p>\n

\"ransomware<\/a><\/p>\n

Having only a difference of 4 bytes in size of 208,008 bytes and 208,004 bytes suggests that the file without the .exe filename extension was decrypted to form the PE executable file. Afterwards, the PE executable was run by the WSF script with the argument: \u201c321\u201d.<\/p>\n

\"ransomware<\/a><\/p>\n

Expanding the Network connections.<\/p>\n

\"ransomware<\/a><\/p>\n

\"ransomware<\/a><\/p>\n

With the com.my<\/em> suffix from the resolved host, the server seems to be located in Malaysia.<\/p>\n

The HTTP header also indicates that the Content-Length was 208,008 bytes. This is the same file size of the encrypted file.<\/p>\n

The WSF file executed by the WScript.exe simply downloaded then decrypted a Windows PE file then executed it.<\/p>\n

The Downloaded Executable PE file<\/strong><\/p>\n

Now we turn our focus on the behavior of the executable file UL43Fok40ii.exe.<\/p>\n

\"Zepto<\/a><\/p>\n