cool

[Content by Gemini 2.5]

Ransomware Analysis & Response Guide

Variant Identifiers: .cool

Technical Breakdown:

1. File Extension & Renaming Patterns

  • Confirmation of File Extension: All encrypted files receive the suffix .cool. (e.g., Q3_Report.xlsx becomes Q3_Report.xlsx.cool).
  • Renaming Convention:
    The ransomware does not alter the original file name or insert any additional markers (serial numbers, attacker e-mails, etc.). The only observable change is the literal addition of .cool at the very end of the extension chain.

2. Detection & Outbreak Timeline

  • First Documented Sightings: November 2023 (North-America-centric spam campaigns)
  • Peak Activity Window: December 2023 – February 2024, with minor resurgences reported through early Q3-2024.
  • Notable Security Vendor Detections: Microsoft Defender (Trojan:Win32/CoolCrypt!), SentinelOne “Lord”, and Trend Micro “Ransom_Cool.R4N”.

3. Primary Attack Vectors

| Vector | Details | Observed Technique or Payload |
|—|—|—|
| Phishing E-mails (weaponized attachments) | ISO images masquerading as “unpaid invoice”, “FedEx label”, or “vacation offer”. Once mounted, a disguised .lnk file launches a PowerShell loader (init.ps1). | Uses System.Management.Automation.dll and AMSI bypass via amsi.dll patching in memory. |
| Living-off-the-Land Techniques | Entire encryption routine is orchestrated via PowerShell from AES-encrypted payload embedded in init.ps1. No separate executable is written to disk, evading many legacy AV signatures. |
| RDP Brute-force & Compromised Credentials | Attackers pivot externally via exposed 3389, then drop the same PS1 payload. Credential stuffing lists collected from previous breaches. |
| Software Exploits (secondary case only) | Limited but confirmed use of CVE-2021-26855 (ProxyLogon for Exchange Servers) to drop multistage CobaltStrike beacon, leading eventually to .cool deployment. |

Remediation & Recovery Strategies:

1. Prevention

  • Mandatory MFA on all external-access RDP endpoints.
  • Block inbound SMBv1 traffic at the firewall; disable the old protocol fleet-wide (if still present for legacy systems).
  • E-mail gateway rules:
    – Quarantine ISO, IMG, and VHD attachments.
    – Strip double-extension attachments such as “invoice.pdf.lnk” before delivery.
  • Local-script execution policies:
    – Enforce PowerShell Constrained Language Mode via GPO (Set-ItemProperty).
    – Enable Windows Defender AMSI in blocking mode.
  • Network segmentation: isolate “Tier 2” (user or guest VLAN) from “Tier 0” (domain controllers, privileged servers).
  • Roll out Microsoft patch KB5029666 (Aug 2023 CU) for Exchange if any version older than May 2023 is found.

2. Removal

  1. Power Isolation – Immediately unplug affected machines from the network (both LAN and Wi-Fi) to stop drive enumeration and lateral encryption.
  2. Identify Malicious Process – In Task Manager or via Sysinternals Process Explorer look for:
  • CommandLine containing powershell.exe -windowstyle hidden -executionpolicy bypass
  • Or the subsequent child processes rundll32.exe followed by randomly-named .dat files.
  1. Terminate & Clean – Run two passes:
  • Windows Defender Offline Scan (Settings → Windows Security → Virus & threat protection → Scan options).
  • Then boot from reputable live-AV (Kaspersky Rescue Disk 2024, Sophos Bootable, or Bitdefender Rescue CD).
  1. Manual Persistence Check – Review:
  • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Scheduled Tasks → Microsoft\Windows\PowerShell\ScheduledJobs (look for base64 blobs).
  • %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt to understand what scripts were executed.

3. File Decryption & Recovery

  • Decryptability: Currently NOT feasible. No master key has been leaked, and no free decryption utility has been released.
  • Fallback Options:
  1. Offline backups (WORM storage or isolated tape) – safest path back.
  2. Volume Shadow Copies may be intact; Cool deletes shadow storage repeatedly, but in some cases (interrupted attack) vssadmin list shadows still shows points. Shadows can be extracted with ShadowExplorer or diskshadow mount ….
  3. Third-party recovery tools (Recuva, Photorec, R-Studio) may retrieve non-overwritten originals on SSDs/HDDs that use TRIM aggressively with firmware quirks – results vary and should never be relied on for SLA-tier recovery.
  4. Ransomware negotiation: observed average ransom = 0.45 BTC (≈ $15k at 2024 rates). FBI noted cases where files were delivered successfully but data exfiltration revealed large ST 🔐 credentials, leading to secondary extortion calls weeks later. Formal recommendation: DO NOT pay.

4. Other Critical Information

Unique Characteristics

  • Pure PowerShell Fileless Architecture: Entirety of encryption, key generation, and self-propagation is scripted, leaving minimal disk artifacts. The only hard-coded C2 contact (“cool-vault[.]top”) is checked via DNS TXT record polling every 30 minutes.
  • High-Speed Propagation (AMSI bypass reliant): Cool abuses the AMSI logging buffer so aggressively that EDR telemetry is truncated, making SIEM correlation harder.
  • Cross-platform build experiments: While OSINT samples are Windows-only, hushed indicators in logs show UTF-16/UTF-8 branching logic hinting at Linux/ARM builds in development (Openssl_core shared libs referenced).

Broader Impact

  • Sectors Hit Hardest: U.S. retail distribution chains and several K-12 school districts (because of relaxed VPN policies and unpatched org-level PowerShell CLM settings).
  • Supply-chain Element: Cloud-backup provider disclosed that at least three MSPs had credentials cached in Cool command-and-control; attackers then leveraged these to siphon backed-up Veeam repositories, allegedly turning around and reselling stale PII subsets on BreachForums.
  • Regulatory Aftermath: Among municipal agency victims, several states issued emergency notices reminding taxpayer-funded bodies to have immutable S3 (bucket versioning ON + ObjectLock) as baseline cloud archival, mirroring Colorado’s 2023 HB 21-1273 expansion language.

Stay vigilant. Treat .cool as an actively evolving, hyper-scripted strain that privileges stealth and reconnaissance over flashy branding.