IQY files and Paradise Ransomware

IQY files, perhaps one of the less known of the weaponizable Microsoft Office file formats, provide attackers with a simple way to infiltrate a network. We have intercepted a campaign that leverages this file type to deliver a new variant of the Paradise ransomware.

IQY, or Internet Query files, are simple text files read by Excel that download data from the Internet. This file type can be leveraged to download an Excel formula (command) that could abuse a system process, such as PowerShell, cmd, mshta, or any other LoLBins (Living-off-the-Land Binaries). As this is a legitimate Excel file type, many organizations will not block or filter it. For organizations that do have security appliances that analyze attachments, these files may not flag as malware, as there is no payload. These appliances would typically rely on the reputation of these URLs, with the more robust solutions having the ability to actually analyze the contents that the URL returns.

The Spam Campaign

This campaign attempts to entice users into opening an IQY attachment (Figure 1), which reaches out and retrieves a malicious Excel formula from the attacker’s C2 server. This formula, in turn, contains a command to run a PowerShell command that will download and invoke an executable (see Figure 2).

While IQY attachments are known to have been distributed by the Necurs botnet [1] to deliver FlawedAmmy RAT [1], this executable is instead tied to the Paradise Ransomware family, which has been around since at least 2017.

As displayed in Figure 3, we observed that this activity spanned just under two days, targeting an organization in Asia.

Paradise Ransomware

This new version of the ransomware contains several interesting static properties (see Figure 4) including:

• Anomalous section names
  • For example: .py
• Lack of imports (indicator of packed code)
  • 5 DLLs
  • 14 APIs
  • APIs associated with dynamically loading code

Unpacking Routine

The unpacking routine is quite interesting in that it leverages a self-injection technique. This involves copying itself to a new location in memory, transferring control flow to the copy of itself, and then replacing the original executable in memory with the unpacked ransomware.

First, a new block of memory is allocated with the WinAPI VirtualAlloc function.

The malware then copies itself to this newly allocated block of memory – rep movsb.

Control flow is then transferred to this copy – jmp eax. This allows the copy to manipulate the original executable (in memory).

The copy then allocates an additional block of memory to begin the unpacking process.

The copy overwrites the original executable (in memory) with NULL bytes – rep stosb, essentially removing the original executable from memory. This is the last step of the unpacking stub, prior to injecting the unpacked executable into this region of memory.

The copy writes the unpacked executable in place of the original executable (in memory) –movsb.

Here is a before/after the unpacking stub of the sample. Notice that the anomalous section names are different, as are many other properties of both the PE and Optional Headers.

The unpacking stub then transfers control flow to the beginning of the unpacked ransomware code.

Dynamic Code Resolution

At the start of the ransomware, WinAPIs of interest are dynamically resolved via manual PEB traversal, just before a language check is performed. The function dubbed find_API (Figure 13) accepts a unique checksum of the WinAPI function to resolve, and a pointer to the DLL to search. This instance of the function returns a pointer to LoadLibraryW.

LoadLibraryW is located by iterating through kernel32’s exports, performing a hashing function on each export name. This hash is then compared against the hardcoded hash of LoadLibraryW – 0x0DCA3722E. Figure 14 shows a snippet of the hashing function, which includes XORing the first four characters of the export name with the key 0xDEADCODE.

Language Check

The function shown in Figure 15 checks to see if the victim’s language ID is that of Russian, Kazakh, Belarusian, Ukranian, or Tatar. If the victim’s language ID matches one of these whitelisted values, the malware exits before performing any malicious activity.

If the language check is passed, the main payload is executed. This function begins with an attempt to disable Windows Defender through setting the registry value for DisableAntiSpyware to 1.

The malware then attempts to kill any processes containing specific strings (see Figure 16). Ransomware will typically force target applications to close to ensure that handles to files of interest are released. This allows the malware to then obtain handles to these important files during the encryption process.

Killing target processes/services:

Crypto Routine

The crypto routine involves traversing the file system (and file systems of network shares), while avoiding certain directories to avoid damaging the system. Those whitelisted directories are:

• Windows
• Recycle.bin
• System Volume Information
• Program Files
• Program Files (x86)

Perhaps the most interesting technique involved in the crypto routine is the algorithm used. The malware leverages Salsa20 to encrypt the victim’s files. The benefit of using this algorithm is that malware authors can implement it into their source code (see Figure 18 and Figure 19 for Salsa20 constants found within the malware code), rather than calling functions from a crypto library. This makes detecting the encryption routine more difficult, and also makes determining the type of encryption being used a bit more challenging for malware analysts. This approach allows the malware to fly under the radar, as AV/EDRs may hook crypto-related WinAPIs (such as CryptEncrypt) to detect such behavior.

This algorithm is applied against a buffer that gets populated with ReadFile. Once the contents of this buffer are encrypted (in memory), the cipher text is written to disk, overwriting the original file.

Here is a before/after of an application being encrypted during the crypto routine.

The file extension is then modified for each encrypted file with MoveFile,using the following syntax: <filename>_decryptor_{unique_id}.tor. As you can see below, the file dirwatch_ui.exe is being renamed to dirwatch_ui.exe_decryptor_{HphFZC}.tor, through the MoveFile function.

The ransom note, titled “—==%$$$OPEN_ME_UP$$$==—.txt” is dropped to disk, and automatically opened upon completion of the encryption routine. This ransom note (Figure 23) instructs the victim to visit an online chat to receive instructions on how to decrypt the files.

The last task the malware completes is a short connection to a URL (iplogger.com) stored in the malware’s resource section.

This appears to just be a simple check-in/notification of infection C2, as no data is sent to C2 in this request. A NULL value is passed as lpOptional parameter to HttpSendRequest.

Interaction with Ransomware Support

To further understand the attack, we made an attempt to interact with the ransomware’s support team. The URL from the ransom note points to the chat’s login page, as shown in Figure 26.

Upon logging in, you are greeted with an automated message, as well as a set of rules for the chat room.

Unfortunately, we never received a reply. What is interesting is that the time date format matches what is used in many European Countries.

Revisiting the static properties of the malware, it has a Compilation Timestamp of 2019-12-08 18:42:38 (UTC), which would fall at around 7:42pm in Europe. The malware was first submitted to VT from an IP with a geolocation of Great Britain, at 2019-12-10 16:08:25 (UTC).

Conclusion

In summary, this campaign exhibited how weaponized IQYs can be an effective technique for an attacker to infiltrate a network. Since these IQYs contain no payload (just a URL), they can be challenging for organizations to detect. Organizations may have to rely on a 3rd party URL reputation service if they do not have appliances in place to analyze and interrogate these URLs.

Although it has been around since at least 2017, public knowledge of the Paradise ransomware is not wide-spread. This ransomware does contain a few evasion techniques that prove to be interesting and effective, such as implementing its encryption algorithm manually/at the source level, to avoid API calls. The algorithm used (Salsa20) is not very commonly employed by ransomware, although it has been observed being leveraged by certain versions of Sodinokobi, and Anatova. Lastly, it is always interesting whenever malware hard-codes a whitelist/blacklist of countries.

References

[1] https://exchange.xforce.ibmcloud.com/collection/Necurs-spreads-FlawedAmmyy-RAT-using-Excel-Internet-Query-attachments-c34ee7d56e1c32ab3592e47bae9f9f53

IOCs

sender	helmut-weiling@t-online.de
sender	kamel111@t-online.de
sender	meinzi@t-online.de
sender	permanent-studio-petra@t-online.de
sender	salamiboy97@t-online.de
sender	sarah.pilcke@t-online.de
sender	stefan.kathrin@t-online.de
sender	w.hiebenthal@t-online.de
sender	blackzor@t-online.de
sender	christianmicheel@t-online.de
sender	dirk.hoetger@t-online.de
sender	heinz-ulrich.link@t-online.de
sender	hendrik.peters14@t-online.de
sender	norokom@t-online.de
sender	polar964@t-online.de
sender	rhcorneli@t-online.de
sender	roland.ruehl@t-online.de
sender	sabrina-munz@t-online.de
subject	RE order_3941943
subject	RE.key-2561
subject	Subject key#20335
subject	subject Offer-57714
subject	Subject offer-96226
subject	subject.:order 4686
subject	subject.key_963064
subject	Subject.order 5366
subject	fwd _1896728
subject	Fwd 104
subject	Fwd:-936300
subject	fwd:offer-6692
subject	fwd.Offer_6568
subject	Re:order 9025
subject	subject:#912352
subject	subject. 40038
subject	subject. 815779
subject	subject.:Offer_4822354
attachment name	0068929.iqy
attachment name	186031.iqy
attachment name	44127.iqy
attachment name	77932.iqy
attachment name	9068.iqy
attachment name	cv_1299934.iqy
attachment name	info 81081888.iqy
attachment name	offer#006155.iqy
attachment name	086309.iqy
attachment name	4310.iqy
attachment name	496969.iqy
attachment name	7109.iqy
attachment name	cv 581109.iqy
attachment name	Offer_52206.iqy
attachment name	Order_5636350.iqy
attachment name	order-5230.iqy
attachment name	profile_94414582.iqy
attachment name	Profile#3973.iqy
URL from IQY	hxxp://ocean-v[.]com/wp-content/1.txt
URL from PowerShell command	hxxp://ocean-v[.]com/wp-content/1.exe
URL from IQY	hxxps://ugajin[.]net/wp-content/upgrade/upd.txt
URL from PowerShell command	hxxps://ugajin[.]net/wp-content/upgrade/key.exe
“Check in” URL	hxxps://iplogger[.]org/1AsWy7
URL from Ransom Note	hxxp://prt-recovery[.]support/chat/25-decryptor
IQY MD5	34517181440f4e9d6371bcb1a3aa8a6f
IQY MD5	8df3bf295bf6002bda1cead3d527403d
Paradise Ransomware (key.exe) MD5	9ac8c2482e25dab49befb711172924f7
1.exe	e1981688506ff4e8b22731d3a0566334
Paradise Ransomware – Full Path	%TEMP%\key.exe
Paradise Ransomware – Full Path (copy)	%APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
Paradise Ransom Note	—==%$$$OPEN_ME_UP$$$==—.txt