Cronus is a .NET based ransomware strain that was first reported on by Seqrite. Threat researchers discovered the ransomware variant after discovering a malicious document that was submitted to VirusTotal. This blog outlines how the ransomware encrypts files and establishes persistence, as well as analyzes the Cronus ransomware note. 

Intrusion Chain

The intrusion chain starts off with a malicious doc that masquerades as an invoice from PayPal. Once the user interacts with the lure and runs the macros, a PowerShell script is downloaded and executed. The PowerShell script loads the Cronus ransomware DLL and executes it. 

All the samples involved in the intrusion chain outlined above are present on VirusTotal. Links to each are provided below.

Sample Analysis

File Details

The file analyzed as part of this blog can be found on VirusTotal. The following table shows information about the sample, including hash values.

When the program is executed it first copies itself to C:\Users\<USERNAME>\AppData\Local. This is done by the function COPY_FILE which reads the name of the application, and checks if the file already exists in the AppData\Local folder. If it exists, it deletes that copy and sleeps. Sleep is called to ensure that the file deletes that version of the ransomware. Once the file has been deleted, it writes a copy of the file to the folder and starts the process.

Once the ransomware has been copied into AppData\Local it iterates through all available drives on the device. During this stage the ransomware is discovering what folders are accessible on the device. This is the precursor to encryption. The malware also contains several exclusions for folders that the malware does not target.

These exclusions are:

• windows.old
• windows.old.old
• amd
• nvidia
• programfiles
• programfiles(x86)
• windows
• $recycle.bin
• documents and settings
• intel
• perflogs
• programdata
• boot
• games
• msocache

Once the folder has been identified, the program gets a list of files within that directory and checks it against a hardcoded list of excluded file names. Figure 7 below shows the list of hardcoded files that are not encrypted by the ransomware.

The table below shows the extensions that the ransomware encrypts.

Once the ransomware identifies a file that has a targeted extension, it checks file attributes to convert read only files to editable files. From there based on the file size, it either encrypts the file by calling FULL_ENCRYPT or TRIPLE_ENCRYPT. Both these functions use the code in the ENCRYPT_DATA function (show in Figure 11) to encrypt files.

For Files < 512 KB

Files less than 512 KB are encrypted using the FULL_ENCRYPT function. This function encrypts data using the AES encryption algothing in Cipher Block Chaining mode. In CBC the input (in this the file) is divided into blocks. The first block is XORed with the initialization vector (IV), a randomly generated set of data, and then encrypted. This encrypted output is then XORed with the next block of plaintext before being encrypted. This process is repeated until the entire file is encrypted. 

For Files > 512 KB

Files greater than 512 KB are using the same encryption process as shown in Figure 11. The only difference is that the encryption process is called three times on different parts of the file. The program is split into three unique sections and each part is encrypted using the ENCRYPT_DATA function.

Terminate Applications 

Cronus binary searches for specific executes by looking for them in the device’s process list. If the application is running, the ransomware binary terminates it before calling the encryption process again.

The full list of applications that the binary attempts to kill are shown below.

Establishing Persistence (T1547.001)

The malware establishes persistence through a registry modification. Upon execution, the malware adds a registry value to the key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

By adding a registry entry here and specifying the path of the malware as the value, it ensures that whenever the user that was logged in accesses the machine again the malware will run, therefore, encrypting data again. 

When Cronus encrypts files, it appends a random 5 character alphanumeric file extension to each encrypted file. This differs from some other ransomware variants which use the same file extension for all encrypted files. The table shows examples of the ransom file extensions added to files when the sample was run in a sandbox.

Ransom Note Analysis

The ransomware drops a ransom note to the file cronus.txt. While the note contains claims of data exfiltration, it differs from the notes dropped by other ransomware families by:

• Threatening bodily harm in the case of non-payment
• Not providing proof of exfiltration

While prominent ransomware families provide links to websites where victims can view a subset of the information taken, Cronus only listed an email. The ransom note states that a decryption tool will be provided once the user sends US$500 in Bitcoin to a wallet and shared confirmation in the form of a transaction id to an email.

The complete ransom note is shown below along with a note from Akira to highlight key differences.

Bitcoin Wallet Analysis

The ransom note specifies that payment be made to specific BitCoin. As of October 4th, 2024, 09:00 EST, this wallet contained no bitcoins, and several tools that track cryptocurrency transactions have no associated activity for that address. It is unclear why the wallet has no transactions, it could be due the fact the victims refused to pay ransoms or that the ransomware deployments were unsuccessful when using that particular wallet.

Conclusion

Apart from reporting by Seqrite, there is no public information about this malware variant. This may indicate limited usage of the ransomware globally. Based on the ransom demands, it appears as if the developers behind the malware are hoping people will pay the low demand to avoid the disruption. 

Recommendations

User Education remains a great way of preventing abuse from malicious documents.

• While Microsoft has moved to disable VBA macros in files from the Internet by default, users can enable them manually.
  • Informing users of the risks of interacting with files that have been shared by unknown senders is a great way of preventing malware infections.

Incident Response Plans and Preparedness is also essential in helping organizations act quickly and effectively during an incident.

• As ransomware remains a major threat to organizations across the world, having an incident response plan is crucial to effectively detect, contain, and mitigate security breaches when they do occur. 
• This plan should outline which parties should be involved in the response, what actions should be taken and at which point should additional stakeholders be involved. 
• In addition to having an incident response plan, organizations should go through incident response tabletop exercises (TTX) to ensure stakeholders are familiar with the plan and their role during an incident.

Cronus Ransomware MITRE ATT&CK TTPs

Appendix - Public Key

References

https://www.seqrite.com/blog/unmasking-cronus-how-fake-paypal-documents-deliver-fileless-ransomware-via-powershell/