A new ransomware called RegretLocker uses a variety of advanced features that allow it to encrypt virtual hard drives and close open files to encrypt them.
RegretLocker was discovered in October 2020 and is a simple ransomware in its view appearances, as it does not contain an intimidating ransom message, and uses an email to communicate instead of a Tor site.
When encrypting files, RegretLocker adds the .mouse extension with harmless sounds to encrypted filenames.
But what makes it particularly dangerous is the advanced features it has that we usually do not see in ransomware infections. See how it works:
When creating a Windows virtual machine Hyper-V, create and save a virtual hard disk to a VHD or VHDX file.
These virtual hard disk files contain a raw disk image, including the partition table, and like regular drives, can range in size from a few gigabytes to terabytes.
When an ransomware encrypts files on a computer, it is ineffective when encrypting a large file as it slows down the encryption process.
In a sample of RegretLocker ransomware discovered by MalwareHunterTeam and analyzed by Vitali Kremez of Advanced Intel , RegretLocker uses an interesting technique of placing a virtual disk file so that each of its files can be encrypted individually.
To do this, RegretLocker uses functions Windows Virtual Storage API OpenVirtualDisk, AttachVirtualDisk and GetVirtualDiskPhysicalPath to mount virtual disks. It specifically looks for the VHD and mounts it when found.
Once the virtual drive is installed as a physical disk in Windows, the ransomware can encrypt each one individually, which increases the encryption speed.
In addition to using the Virtual Storage API, RegretLocker also uses the Windows Restart Manager API to terminate Windows processes or services that keep a file open during encryption.
Windows Restart Manager is only used by some ransomware such as ta REvil (Sodinokibi), Ryuk, Conti, ThunderX / Ako, Medusa Locker, SamSam and LockerGoga.
RegretLocker is not yet very active, but it is a new family to watch.
