New ransomware fakes Windows Update to trick home users

[vtqhtr413]

Content source

https://www.ghacks.net/2023/07/09/big-head-ransomware-fakes-windows-update-to-trick-users/

Security researchers at FortiGuard Labs have discovered a new type of ransomware that is targeting home computer users. Dubbed Big Head, the ransomware fakes Windows Update to avoid detection. The researchers note that there are two main strains of the ransomware and multiple variants. The attack targets Windows users. Upon successful infection, the ransomware will encrypt files on systems that it compromised to demand ransom for file decryption. At least one variant of Big Head disguises itself as an update for Microsoft Windows. Once executed, it displays a "Configuring critical Windows Updates" screen to the user that fakes legitimacy.

Fortinet notes that this fake update screen lasts for about 30 seconds and counts to 100% in the process. It closes automatically after the ransomware has encrypted a sizeable number of files on the user system. The file names are modified randomly according to the researchers. A ransom note is opened, which begins with README_ followed by a random seven digits number. The creator of the ransomware asks the user to establish contact via email or Telegram to pay a ransom and regain access to the encrypted files using file decryption instructions.

Researchers at Trend Micro provide additional technical details on the Big Head ransomware family. The ransomware drops three executable files on the attacked machine, 1.exe, archive.exe and Xarch.exe, which serve different purposes. 1.exe, for example, creates an autorun Registry key so that it is executed on every startup of the system. It hides the console window furthermore and creates a copy of itself, which it saves as discord.exe to the <%localappdata%> folder.

 

[Jonny Quest]

I was wondering, if we update through Windows itself, from our Windows update, how could this happen? This was in the article:
It is unclear at this point how the ransomware is distributed. The researchers found one variant with a Word icon, which could indicate distribution as a fake application.

 

[upnorth]

I was wondering, if we update through Windows itself, from our Windows update, how could this happen? This was in the article:
It is unclear at this point how the ransomware is distributed. The researchers found one variant with a Word icon, which could indicate distribution as a fake application.

fake Windows updates and fake Word installers.

Tailing Big Head Ransomware’s Variants, Tactics, and Impact

www.trendmicro.com

 

[HarborFront]

Many AV/AM at VirusTotal already detecting it

VirusTotal

VirusTotal

www.virustotal.com

 

[cruelsister]

BigHead is one of the most poorly coded ransomware files that can be found, with some variants even unable to encrypt anything (nice splash screen, though). I'm starting to thing that FortiGuard is more interested in Click-Bait press releases than actually providing analysis of more relevant (and nastier) stuff.

 

[upnorth]

Many AV/AM at VirusTotal already detecting it