by Stephen Hilt and Fernando Mercês
Since first writing about thediscovery of HDDCryptor back in September, we have been tracking this ransomware closely as it has evolved. Last week, a new version was spotted in the wild, and based on our analysis, we believe that this variant is the one used in a recent attack against San Francisco Municipal Transport Agency (SFMTA).
In this attack, as we’ve seen with other versions of HDDCryptor, the ransomware dropped some tools to perform full disk encryption, as well as the encryption of mounted SMB drives. We believe the threat actors behind the attack don’t use exploit kits and automated installers to instantly compromise and infect victims. Instead, they first attempt to gain access to the machine, most likely through a more targeted attack or exploit, before manually triggering and executing the malware. While we don’t have specific information on how this was accomplished across SFMTA’s 2,000 machines, it is highly likely that it was through scheduling a job to run on all of the devices using some form of admin credentials.
When contacted, the actors using this new HDDCryptor replied with a similar message to the one seen at the CSO online article .
Figure 1. The attacker’s e-mail response that includes instructions on how to obtain Bitcoin
How has HDDCryptor Evolved?
Previously, HDDCryptor did all of this with a user account that was added, which in September was “mythbusters.” Shortly after, it was observed to add a user of “ABCD,” as the creators had likely changed the username to avoid detection. In the most recent observed version as of last week, HDDCryptor no longer adds a user, however it creates a path of “ C:\Users\WWW ” in which it drops the files needed to perform the encryption of both the local hard drive and any attached file shares.
Figure 2. Components dropped by HDDCryptor
After trying to encrypt remote network shares, the ransomware puts into place all the pieces needed for local encryption and the system is rebooted once. Then, HDDCryptor starts performing what it needs.