Readers like you help support my blog. When you make a purchase using links on our site, we may earn an affiliate commission! Thank you!

Thursday, May 28, 2015

Locker Ransomware Support Topic - General Security

This is the support topic for the Locker Ransomware.
The Locker ransomware has a very large install base that has affected
many people globally. As this topic is already quite large, and will
likely grow larger, this first post will be used to post any new
information as it becomes available.



Summary

The
Locker ransomware is a computer infection that silently runs on a
victim's computer until May 25 Midnight local time at which point it
became active. Once active, it will begin to encrypt the data files on
the computer with what appears to be RSA encryption. When encrypting the
data files it will not change the extension of the
file. Therefore, the only way to determine if the file is encrypted is
by trying to open it and being told that the file is corrupt or not
usable.

After the Locker ransomware encrypts your data it will
delete your shadow volume copies and then display the Locker interface.
This interface will be titled Locker and then a random version number.
This version number does not appear to have any significance. Some
example titles are Locker v1.7, Locker v3.5.3, Locker V2.16, and Locker
V5.52. This Locker screen will give you information on how to pay the
ransom, your unique bitcoin address to send the ransom to, a list of
encrypted files, and a page to check the status of your payment. More.....


Locker Ransomware Support Topic - General Security

Tuesday, May 26, 2015

Locker ransomware hides until midnight on May 25th and then encrypts your data - News



A new ransomware called Locker has been discovered that
once installed lay dormant until midnight local time on May 25th when
it would activate and encrypt your data files. Once your files were
encrypted it would demand .1 bitcoins in order to decrypt your files. If
payment was not made within 72 hours, the ransom price would then
increase to 1 bitcoin. This ransomware is currently widespread with
global targeting. More.....

Locker ransomware hides until midnight on May 25th and then encrypts your data - News

Sunday, May 24, 2015

(UAC) User Assisted Compromise - Room362.com

A number of times during tests I’ve actually run into those mythical creatures called “patched windows machines”. At DerbyCon Chris Gates and I released the “Ask” post module (which I had failed to publish). This module very simply uses the ShellExecute windows function via Railgun with the undocumented (but very well known) operator of ‘runas’. These two lines accomplished that:



(UAC) User Assisted Compromise - Room362.com

Trick me once, ShameOnUAC



ShameOnUAC

When the Cylance SPEAR Team was formed late last year we started
looking into an area that we had long wanted to study: the potential for
subverting programs during privilege elevation through UAC. We created
proof of concept malware that attacks Windows Explorer, which we dubbed
ShameOnUAC.


ShameOnUAC injects itself into the unprivileged Explorer process,
where it hooks SHELL32!AicLaunchAdminProcess and waits for the user to
ask to run a program as administrator. It then then tampers with the
elevation requests before they're sent to the AppInfo service. (This is a
downside of having an unprivileged process submit elevation requests
for you.)


Here's how UAC works normally:





Trick me once, ShameOnUAC

Installer stuck at 18% when upgrading from Windows 10 (10074 to 10122) - Enterprise Mobility Tips - Site Home - TechNet Blogs

Are you trying to upgrade to Windows 10 preview build 10122 and the
installation hangs at 18%? The following approach unblocked me,
hopefully it works for you too – please let us know in the comments:


  • Download psexec.exe from sysinternals to e.g. c:\temp
  • Open an elevated command prompt
  • Execute psexec with the following parameters (try not to copy/paste):
    • C:\Temp\psexec.exe –s –i cmd.exe
  • A command prompt in the system context should launch: 
  • More....
Installer stuck at 18% when upgrading from Windows 10 (10074 to 10122) - Enterprise Mobility Tips - Site Home - TechNet Blogs

Debugging Tutorial Index - Sysnative Forums

 !tz and !tzinfo WinDbg Extensions - Thermal Zone ACPI Trip Levels

Debugging Tutorial Index - Sysnative Forums

Meet 'Tox': Ransomware for the Rest of Us - McAfee

The packaging of malware and malware-construction kits for cybercrime
“consumers” has been a long-running trend. Various turnkey kits that
cover remote access plus botnet plus stealth functions are available
just about anywhere. Ransomware, though very prevalent, has not yet
appeared in force in easy-to-deploy kits.


But now we have Tox–and it’s free.



Meet 'Tox': Ransomware for the Rest of Us - McAfee