crypren

Community Ransomware Resource
Ransomware Variant: CRYpREN
(Identified primarily by the extension “.crypren” and the ransomware-note name “!README_CRYPREEN!.rtf”)

Technical Breakdown

1. File Extension & Renaming Patterns

• Extension Used: Every encrypted file receives the “.crypren” suffix appended after retaining the original extension.
  invoice.xlsx → invoice.xlsx.crypren
• Renaming Convention:
  – Preservation of the original file name and path – only the extra extension is added, so backups of NTFS Master File Table entries may still contain the correct file names even after encryption.
  – After encryption a mutex named Global\69C27E2C-75AB-4DB7-95E6-9DD645E9F0F8 is created to prevent reinfection.

2. Detection & Outbreak Timeline

• First largely reported: Late August 2022 in Telegram- and Dark-forum chatter, with a noticeable uptick September 2022 → March 2023 in North-American and APAC healthcare and K-12 sub-sectors.
• Embedded compile timestamp: 12 Aug 2022 (UTC-0). IOC signature persistence started to be recorded in VT the same week (malicious samples SHA256: e0fe476d…, 1b091c92…, etc.).

3. Primary Attack Vectors

• Remote Desktop Protocol (RDP)
  – Brute-force/default credential sweeps → manual follow-up with living-off-the-land techniques (PowerShell, WMIC, PSExec).
• Proxying via “Cobalt Strike” beacons dropped by:
  – ProxyLogon and ProxyShell chains to gain OWA/Exchange footholds.
  – Phishing e-mails with ISO or 7-Zip attachments that host a signed HTA/VBS dropper signed with stolen certificates.
• File-Server exploitation: Uses an SMB1 EternalBlue-style (customized) module only against a hard-coded list of common network share names (\\<IP>\C$\, D$\shared, etc.).
• Privilege escalation:
  – DirtyPipe (CVE-2022-0847) against un-patched Debian-based Docker hosts (common in MSSP environments).