RegretLocker: A new strain of ransomware that targets Windows virtual machines

A new ransomware strain called RegretLocker has been found to use a host of advanced features to encrypt virtual hard drives and close open files on the target system to encrypt unauthorized data.

In fact, RegretLocker was first spotted in October, and is judged to be a formally simple ransomware strain because it doesn't contain lengthy ransom notices and specifically only uses email for communications. to the victim, not a regular Tor payment site.

RegretLocker: A new strain of ransomware that targets Windows virtual machines Picture 1

RegretLocker's ransom notes

Once a file is successfully encrypted, RegretLocker adds a harmless sounding .mouse extension to the filename. But in fact, hidden inside it is an extremely unique encryption mechanism.

RegretLocker: A new strain of ransomware that targets Windows virtual machines Picture 2

The file after being encrypted by RegretLocker

RegretLocker's dangerous encryption technique

When setting up a Windows Hyper-V virtual machine, a virtual hard disk is also created and stored in a VHD or VHDX file.

These virtual hard disk files contain raw disk images, include the partition table of the virtual drive and the partitions that are similar to regular drives, and can range in size from several GB to TB rows.

When ransomware encrypts data on your computer, encrypting a large file is ineffective because it slows down the speed of the entire process. In a ransomware sample discovered by MalwareHunterTeam and analyzed by Advanced Intel security engineer Vitali Kremez, RegretLocker used a relatively unique encryption technique, which is to mount virtual disk files for individual encryption.

ingredients quickly and easily. To implement this technique, RegretLocker uses the Windows Virtual Storage APIs OpenVirtualDisk, AttachVirtualDisk, and GetVirtualDiskPhysicalPath for the purpose of mounting the virtual disk.

RegretLocker: A new strain of ransomware that targets Windows virtual machines Picture 3

The malware mounts a VHD file

After the virtual drive has been mounted as a physical disk in Windows, ransomware can completely encrypt each individual drive, thereby significantly increasing encryption speed.

In addition to using the Virtual Storage API, RegretLocker was found to abuse the Windows Restart Manager API to terminate Windows processes or services that left files open during encryption.

When using this API, if the name of the process contains 'vnc', 'ssh', 'mstsc', 'System' or 'svchost.exe' then ransomware will not terminate that process. This exception list can be used to prevent important programs or programs used by hackers to access the target system from being accidentally stopped. The Windows Restart Manager API is currently only used by some popular ransomware such as REvil (Sodinokibi), Ryuk, Conti, ThunderX / Ako, Medusa Locker, SamSam, and LockerGoga.

RegretLocker: A new strain of ransomware that targets Windows virtual machines Picture 4

Windows Restart Manager Exceptions List

RegretLocker is not very active yet and is really popular right now, but this is clearly a dangerous ransomware strain that needs to be kept an eye out for now.

RegretLocker

Micah Soto

Update 06 November 2020

You should read it

May be interested

How to export Hyper-V virtual machines in Windows 10
you can use hyper-v export and import functions to quickly copy virtual machines. virtual machines that are accessed can be used for backup or as a way to migrate a virtual machine between hyper-v servers.
Detecting a new ransomware strain that specializes in stealing login information from the Chrome browser
a ransomware strain called qilin was recently discovered using a relatively sophisticated tactic, with high customization capabilities, to steal account login information stored in the google chrome browser. .
Create virtual machines in Hyper-V on Windows Server 2008
after hyper-v is installed, the first thing to do here is to create a virtual machine - virtual machine. in the following article, we will introduce you to some basic steps to do this, with the general implementation process almost just clicking next> next> finish.
What is Epsilon Red Ransomware?
a new ransomware threat, called epsilon red, targets unpatched microsoft-based servers in enterprise data centers.
What is Ransomware Ryuk? How to prevent it?
cybercriminals are using a new form of ransomware to target large businesses and take money from it. since august, the ryuk team has made $ 4 million by installing malicious encryption software on high-value targets.
New ransomware strain discovered using leaked Windows and Linux encryption
a new ransomware operation called 'buhti' uses leaked code of the lockbit and babuk ransomware families to target windows and linux systems
Virtual machines without TPM 2.0 are prohibited from installing Windows 11 Insider Preview
it seems that microsoft is tightening the list of devices that can install windows 11 insider preview.
7 kinds of ransomware you didn't expect
most people know the process of making a ransomware, which is why ransomware creators are always looking to find and create new ransomware to make you pay. here are some new ransomware you should know.
Add drives for virtual machines running Windows XP on VirtualBox
normally, virtual machines are set up for fixed storage, and once you reach that limit, you may feel confused, unless you know how to add virtual drives to the machine.
How to rename Hyper-V virtual machines using PowerShell and Hyper-V Manager
sometimes when you create a hyper-v virtual machine, you must give it a name and sometimes the naming is incorrect or simply you no longer want to use that name. this article will provide three methods to rename a hyper-v virtual machine to your liking.

RegretLocker: A new strain of ransomware that targets Windows virtual machines

RegretLocker's dangerous encryption technique

You should read it

May be interested

Attack the network