Does typical Ransomware only 'attack' certain folders/filetypes

Question

I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical.

A user's computer has been infected by a piece of malware which aims to encrypt all their files to extort money. Obviously it's not going to encrypt everything as the computer will need to remain operation in order to try exploit money from the end user and reduce risk of detection whilst in operation.

How does the ransomware know what's safe to encrypt without accidently 'shooting itself in the foot'.

• Does it go for certain 'typical' folders say ${userhome}\pictures|music|documents|etc.
• Does it go for certain expected file types, e.g. doc|jpeg|mp3.
• Does it go for everything except certain folders (e.g windows or program files).

Also what happens if there are multiple drives (so SSD for programs and OS, HDD for files and network drives for shared programmes/files etc) or if programs are not stored in the typical places?

I know at the end of the day the attacker doesn't care if they brick a victims machine, but surely if they were to brick every machine then they wouldn't be able to extort money thus bypassing the whole ransom aspect. (The obvious answer being they expect average users just to follow the same default folder structures).

Answer 1

As far as I know typical ransomware, like the (in)famous Locky virus for example, encrypt files depending on their file extension and across all local and remote drives.

To break it down:

The ransomware will scan the system for

• Local drives (System drive, secondary drive, USB drive and so on)
• Remote drives (Network shares like samba, nfs and so on)
• Files with certain, predefined file types (e.g.: .jpg, .avi, .doc)

This way no important OS files are touched but the attackers still have their 'hostages'.

If you want to know, which files on your system would be affected rootshell.be has written a batch script to estimate which files would be affected on your system. The currently used extensions which the script looks for are the ones Locky uses. Of course different ransomware can use different extensions or even work different like Petya. Petya works by overwriting the MBR and booting into a minimalistic own OS while the C:\ drive gets encrypted completely in background.

Sources (If you want further reading):

• Malwarebytes Blog on Locky
• TheHackerNews on Locky
• TrendMicro on ransomware in general
• Ransomware simulation script by rootshell.be

Answer 2

Think about the attack from an attacker's point of view. Should I only encrypt where they MIGHT store information, or should I encrypt everything but what I know takes to make the OS run?

So the short of it is they encrypt all but certain locations, the known operating system folders. Since those are extremely well known of course, they can simply exclude those from the encryption process and encrypt everything else. With the new cryptolocker variants, they are actually now moving onto networks in an effort to compromise corporate networks to get bigger payouts, so they will see networked drives and go after those as well. Now of course these depend on the ransomware and the variant of that ransomware.

For some more technical details on the exact threat of Cryptolocker specifically: https://www.us-cert.gov/ncas/alerts/TA13-309A

Answer 3

It depends on your definition of typical - that is a moving target. We have now seen the first instance of ransomware named Petya that, rather than encrypting the files, encrypts the Master File Table and the Master Boot Record (MBR). And the MFT essentially manages all file information.

If you encrypt the MFT, you don't have to encrypt the files (much faster!). Petya replaces the master boot record with a big, scary red-and-white skull-and-crossbones painted in dollar signs on the screen. And since the system needs to read the MBR/MFT every time on reboot, there's no bypassing this (other than backups).

Luckily the ransomware authors made a mistake and it is possible to get your data back, but you can be sure that a) the next versions of the malware will have this fixed and b) copycats will start doing this as well.