Another interesting feature is highlighted when we examine the date the file was compiled : 28-10-2022. This clue is further evidence that Hairysquid turns out to be a newer version of the previously mentioned Mimic Ransomware.

The ransomware is extracted from an executable file with dropper functions. In this case it is a "dropper-unpacker" malware that contains within it the final ransomware payload and all the libraries necessary for its proper functioning. The unpacking step is done through one of the libraries inside the dropper called 7Zip.
 

In the first phase, the DC.exe (DefenderControl) process is executed, through which the ransomware disables Windows Defender protection and modifies Windows GroupPolicy:

 

 

 

The Windows registry key is modified to disable Real-Time-Protection of Windows Defender:

 

  

Disabling Windows Defender is essential for the ransomware to work properly because if no antivirus program is present on the PC, Windows Defender is the first to thwart the malicious program.

A file called "Registry.pol" is also created inside the path "C:\Windows\System32\GroupPolicy\Machine\" which disables Windows AntiSpyware via Windows policies. Below are the contents of the above file:

"PReg[Software\Policies\Microsoft\WindowsDefender;DisableAntiSpyware;]"

In the second phase, a list of all physical and/or virtual directories (folders/disks) is created. This is done through libraries included in a software called "Everything".."Everything" is a utility that allows the user to quickly locate all files/directories on the victim's computer and then proceed with their encryption. Once the directories and folders on the PC have been identified, they are entered into a text database called "Everything.db" used to later retrieve information useful for data encryption.


 

 

The extensions that are considered by Hairysquid for data encryption are as follows:
 

 
In the third phase, a series of powershell.exe processes are executed to search for virtual machines present within the PC; this search is important because  large companies very often use server machines that host within them virtual machines used by various users inside the company.
Obviously, these virtual machines turn out to be a great "loot" for criminals since, once encrypted, they will no longer be usable by users.
 

 

 
In the fourth phase, all ongoing remote connections are closed, so that connected users are disconnected and have no longer control over the machine. At the same time, the TaskManager is shut down and disabled. In addition the registry key is changed to completely disable its execution. In this way the user is not given the opportunity to close the running malicious process before it finishes encryption.
In addition the processes include:
 

• powercfg.exe  with which it disables system shutdown, suspension and hibernation                                                                                

 

• bcdedit.exe  used to inhibit system configuration restoration:                          

• wbadmin.exe  Used to delete backups of the system configuration                        

• wmic.exe with which it deletes shadow copies of Windows                                           

When the encryption is finished, a folder named "temp" is created on the C: drive. It contains a text file called "READ_ME_DECRYPTION_HAIRYSQUID.txt" in which we find the contact details of the crimnals, instructions for making the ransom payment, and information for receiving the decryptool useful for decrypting the data.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  
with the name:
 
Defender.exe with the value > notepad.exe "C:\temp\READ_ME_DECRYPTION_HAIRYSQUID.txt"

which, each time the PC is started, shows the ransom request. See below:



In the ransom payment instructions we also find ways to contact the criminals via various messaging channels such as:

• Tox Messenger
• ICQ Messenger
• Skype
• eMail

Cases like this are proof of the importance of defending our data with proper anti-cryptomalware security systems.
.
TG Soft has developed and integrated since May 2015 in the Vir.IT eXplorer PRO suite - the only product with a proprietary engine developed 100% in Italy - AntiVirus, AntiSpyware and AntiMalware, AntiRansomware Crypto-Malware protection technologies. These through the heuristic-behavioral approach, are able to block the encryption process in the initial phase of the attack saving, on average, at least 99.63% of the data files otherwise potentially encrypted without this protection.

In addition, as a last parachute for some data files that may be neither restorable nor recoverable by the integrated restore/recovery tools, we can restore them from Vir.IT BackUp  integrated in the Vir.IT eXplorer PRO suite.

 

For more information on these technologies which are 100% developed  in Italy, you can contact the
TG Soft Cyber Security Specialist administrative office, sending an email to segreteria@tgsoft.it or calling the telephone number 049.8977432.




IOC: