SarinLocker Ransomware – CYFIRMA

MITRE Techniques

• [T1204.002] Malicious File – The main function of the binary calling other functions like “SatrtEncryption”, “Telegram” etc. is for executing specific tasks. ‘the main function of the binary calling other functions like “SatrtEncryption”, “Telegram” etc. is for executing specific tasks.’
• [T1112] Modify Registry – The SetWallpaper function opens the registry key, “HKEY_CURRENT_USERControl PanelDesktop” in write mode. ‘The SetWallpaper function is responsible for setting the wallpaper on a Windows desktop. The function opens the registry key, “HKEY_CURRENT_USERControl PanelDesktop” in write mode.’
• [T1012] Query Registry – T1012: Query Registry
• [T1082] System Information Discovery – T1082: System Information Discovery
• [T1113] Screen Capture – The Telegram function retrieves the current username and machine name, takes a screenshot of the desktop and saves it to a specified location on the local machine. ‘The ransomware first collects the information of user like username, constructs a path to the user’s directory, and subsequently calls the “EncryptDirectory” method to encrypt the files in the user’s directory, using the encryption password calculated at runtime.’
• [T1071] Application Layer Protocol – The Telegram communication uses an API call to notify a Telegram chat about infection. ‘It first sets the security protocol to Tls12… and then sends a request to the specified URL… with the message string as a parameter.’
• [T1048] Exfiltration Over Alternative Protocol – Exfiltration of victim information to Telegram. ‘the ransomware also exfiltrates victim’s information to Telegram.’
• [T1486] Data Encrypted for Impact – The ransomware encrypts files using AES-256-CBC and renames them with a SARIN.XXX extension. ‘Finally, the ransomware renames the encrypted file with an additional extension “SARIN.XXX”.’