Qwerty Ransomware

Qwerty is ransomware that utilises legitimate free tools to encrypt a user's files.

Threat ID:: CC-2145
Category:
Threat Severity:: Low
Threat Vector:
Published:: 15 March 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Qwerty is ransomware that utilises legitimate free tools to encrypt a user's files.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - all versions

Threat details

The method of distribution is currently unknown, but it is speculated that attackers may be delivering the file manually via hacking Remote Desktop Services.

The Qwerty package includes a batch file which executes a series of commands. It firstly imports the encryption keys using GNU Privacy Guard (GnuPG). It then launches a JavaScript file which runs the encryption program across all mapped volumes.

The encryption program firstly closes some running processes, including any web browsers. It then deletes all shadow copies and Windows Server backups on the system, edits the Boot Configuration Data to disable the recovery environment and empties the recycle bin.

Files on the volume are then encrypted using GnuPG, excluding programs and operating system files. Qwerty uses an asymmetric encryption method, so it is not feasible to decrypt files without the private key held by the attacker. However this also means that encryption is relatively slow, and if detected the process may be halted by shutting down the system. Encrypted files are named with the .qwerty extension. After each file is encrypted, GNU Shred is run on the original file in order to overwrite it.

A ransom note is saved in each folder where a file has been encrypted, asking the user to email in order to receive payment instructions.

Remediation steps

Type	Step
	Qwerty only overwrites original files once, and so data may be recoverable with appropriate file recovery software. As with all forms of zero-day malware, the first line of defence against new variants of ransomware is user awareness and safe working practices. To avoid becoming infected with ransomware, ensure that: A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, antivirus and other security products are kept up to date. All day to day computer activities such as email and internet are performed using non-administrative accounts and that permissions are always assigned on the basis of least privilege. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the “10 Steps to Cyber Security”. To limit the damage of ransomware and enable recovery: All critical data must be backed up, and these backups must be sufficiently protected/kept out of reach of ransomware. Multiple backups should be created including at least one off-network backup (e.g. to tape).

Type

Step

Qwerty only overwrites original files once, and so data may be recoverable with appropriate file recovery software.

As with all forms of zero-day malware, the first line of defence against new variants of ransomware is user awareness and safe working practices.

To avoid becoming infected with ransomware, ensure that:

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, antivirus and other security products are kept up to date.
All day to day computer activities such as email and internet are performed using non-administrative accounts and that permissions are always assigned on the basis of least privilege.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the “10 Steps to Cyber Security”.

To limit the damage of ransomware and enable recovery:

All critical data must be backed up, and these backups must be sufficiently protected/kept out of reach of ransomware.
Multiple backups should be created including at least one off-network backup (e.g. to tape).

Last edited: 17 February 2020 12:53 pm