{"id":86033,"date":"2018-03-19T18:26:40","date_gmt":"2018-03-19T12:56:40","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=86033"},"modified":"2018-03-19T18:26:40","modified_gmt":"2018-03-19T12:56:40","slug":"analysis-zenis-ransomware-quick-heal-security-labs","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/analysis-zenis-ransomware-quick-heal-security-labs\/","title":{"rendered":"An analysis of the Zenis ransomware by Quick Heal Security Labs"},"content":{"rendered":"<p>Quick Heal Security Labs has come across a new ransomware that goes by the name \u2018Zenis\u2019. The ransomware not only encrypts files but also intentionally deletes the infected system\u2019s backup.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>The behavior of Zenis ransomware<\/strong><\/p>\n<p>Upon inside a computer, the ransomware performs the following checks before it starts encrypting the user\u2019s data.<\/p>\n<ul>\n<li>Whether the executed file\u2019s name is \u2018iis_agent32.exe\u2019 (this check is not case sensitive)<\/li>\n<li>Looks for the registry and checks if its value is \u2018Active\u2019 and the registry value is \u2018HKEY_CURRENT_USER\\SOFTWARE\\ZENISSERVICE\u2019.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>If either one of these checks is not fulfilled, the ransomware halts the process and does not proceed any further. On the other hand, if these checks are complete, Zenis fires the below commands to disable the Windows <strong>repair and backup<\/strong> option using Vssadmin.exe. <em>Vssadmin.exe is used to create and manage shadow volume copies on the drive.<\/em><\/p>\n<ul>\n<li>cmd.exe \/C vssadmin.exe delete shadows \/all \/Quiet<\/li>\n<li>cmd.exe \/C WMIC.exe shadowcopy delete<\/li>\n<li>cmd.exe \/C Bcdedit.exe \/set {default} recoveryenabled no<\/li>\n<li>cmd.exe \/C Bcdedit.exe \/set {default} bootstatuspolicy ignoreallfailures<\/li>\n<li>cmd.exe \/C wevtutil.exe cl Application<\/li>\n<li>cmd.exe \/C wevtutil.exe cl Security<\/li>\n<li>cmd.exe \/C wevtutil.exe cl System<\/li>\n<\/ul>\n<p>After executing the above commands, Zenis starts its encryption activity. Our analysis says that the ransomware basically encrypts non-PE files. Below are the extensions which the ransomware encrypted successfully during the scenario generated at Quick Heal Security Labs.<\/p>\n<blockquote><p>.txt, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt, .jpeg, .png, .csv, .sql, .mdb, .sln, .php, .asp, .aspx, .html, .xml, .psd, .sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .p7c, .pk7, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt<\/p><\/blockquote>\n<p>&nbsp;<\/p>\n<p>Zenis drops infection marker files and encrypted files which have the following pattern. <em>Z<\/em><em>enis-[2 random chars].[12 random chars].<\/em><\/p>\n<p>For example, \u2018example.txt\u2019 would be encrypted and renamed with a pattern like \u2018Zenis-4V.4V7sb2JRmLNs.\u2019<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86035\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/03\/1.jpg\" alt=\"\" width=\"613\" height=\"531\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/1.jpg 613w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/1-300x260.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/1-450x390.jpg 450w\" sizes=\"(max-width: 613px) 100vw, 613px\" \/><\/p>\n<p style=\"text-align: center\">Fig 1. Files encrypted by Zenis<\/p>\n<p>While searching for the files to encrypt, if Zenis finds any backup files, it overwrites them three times and then deletes them. This makes it almost impossible for the affected user to restore their files from the backup.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Below are the extensions which the ransomware is programmed to delete:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<blockquote><p>.wbb,.qic, .old, .obk, .ful, .bup, .bkup, .bkp, .bkf, .bff, .bak, .bak2, .bak3, .edb, .stm,.win,w01, .v2i, .trn, .tibkp, .sqb, .rbk<\/p><\/blockquote>\n<p><strong>Zenis ransom note<\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-86037\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/03\/2.jpg\" alt=\"\" width=\"1139\" height=\"730\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/2.jpg 1139w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/2-300x192.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/2-768x492.jpg 768w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/2-609x390.jpg 609w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/2-789x506.jpg 789w\" sizes=\"(max-width: 1139px) 100vw, 1139px\" \/><\/p>\n<p style=\"text-align: center\">Fig.2 Ransom Note by Zenis<\/p>\n<p><strong>How does Zenis spread?<\/strong><\/p>\n<p>The exact propagation technique used by the ransomware is not exactly known. But, some speculate that hacked desktop remote services may have spread it.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>How Quick Heal protects its users from the Zenis ransomware<\/strong><\/p>\n<p>Apart from the static detection, <a href=\"https:\/\/bit.ly\/2ncPU26\">Quick Heal\u2019s Behaviour Detection<\/a> and Anti-Ransomware successfully eliminate this threat.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-86039 aligncenter\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/03\/3.jpg\" alt=\"\" width=\"460\" height=\"264\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/3.jpg 460w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2018\/03\/3-300x172.jpg 300w\" sizes=\"(max-width: 460px) 100vw, 460px\" \/><\/p>\n<p style=\"text-align: center\"><strong>Fig 3.<\/strong> Quick Heal Anti-Ransomware feature<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-86038 aligncenter\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2018\/03\/4.jpg\" alt=\"\" width=\"469\" height=\"246\" \/><\/p>\n<p style=\"text-align: center\"><strong>Fig 4.<\/strong> Quick Heal Behavior Detection feature<\/p>\n<p><strong>Indicators of compromise<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>MD5:<\/li>\n<\/ul>\n<p>8CD8D46CD6C7E336D2BAA2F78D8D0AB4<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Dropped artifact:<\/li>\n<\/ul>\n<p>Zenis-Instructions.HTML<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Registry key:<\/li>\n<\/ul>\n<p>HKEY_CURRENT_USER\\software\\ZenisService \u201cActive\u201d<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>Dropped artifact: &#8211;<\/li>\n<\/ul>\n<p>Zenis-Instructions.HTML<\/p>\n<p>&nbsp;<\/p>\n<p><strong>How to stay away from ransomware<\/strong><\/p>\n<ul>\n<li>Use a multi-layered antivirus that can stop real-time threats.<\/li>\n<li>Keep your antivirus up-to-date.<\/li>\n<li>Update your Operating System regularly as critical patches are released almost every day.<\/li>\n<li>Keep your software up-to-date. Older and outdated versions of software have vulnerabilities which are almost always exploited by attackers to infect a system with ransomware and other malware.<\/li>\n<li>Never directly connect remote systems to the Internet. Always use a VPN (Virtual Remote Network) to access a network remotely.<\/li>\n<li>Do not click on links or download attachments in emails received from unexpected or unknown sources.<\/li>\n<li>Take regular data backup and keep it in a secure location.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>Subject Matter Expert<\/strong><\/p>\n<p>Priyanka Dhasade |Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Quick Heal Security Labs has come across a new ransomware that goes by the name \u2018Zenis\u2019. The ransomware not only encrypts files but also intentionally deletes the infected system\u2019s backup. &nbsp; The behavior of Zenis ransomware Upon inside a computer, the ransomware performs the following checks before it starts encrypting the user\u2019s data. Whether the [&hellip;]<\/p>\n","protected":false},"author":39,"featured_media":86047,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-86033","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86033"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/39"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=86033"}],"version-history":[{"count":9,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86033\/revisions"}],"predecessor-version":[{"id":86046,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86033\/revisions\/86046"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/86047"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=86033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=86033"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=86033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}