{"id":852,"date":"2023-07-10T14:16:42","date_gmt":"2023-07-10T14:16:42","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/big-head-ransomware-za-vrijeme-enkripcije-prikazuje-lazno-windows-azuriranje\/"},"modified":"2026-11-04T08:52:33","modified_gmt":"2026-11-04T08:52:33","slug":"big-head-ransomware-za-vrijeme-enkripcije-prikazuje-lazno-windows-azuriranje","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/big-head-ransomware-za-vrijeme-enkripcije-prikazuje-lazno-windows-azuriranje\/","title":{"rendered":"Big Head ransomware za vrijeme enkripcije prikazuje la\u017eno Windows a\u017euriranje"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Trend Micro je objavio <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/23\/g\/tailing-big-head-ransomware-variants-tactics-and-impact.html\" target=\"_blank\" rel=\"noreferrer noopener\">tehni\u010dko izvje\u0161\u0107e<\/a> o novom ransomwareu nazvanom <strong>'Big Head'<\/strong>, \u010dije je ranije ina\u010dice istra\u017eivao i <a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/fortiguard-labs-ransomware-roundup-big-head\" target=\"_blank\" rel=\"noreferrer noopener\">Fortinet<\/a>. Tvrde da sve tri ina\u010dice potje\u010du od istog aktera koji prilago\u0111ava pristup napada.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Za vrijeme kriptiranja podataka korisniku na prikazuje la\u017eni proces a\u017euriranja Windowsa.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Big Head je .NET binarna datoteka koja instalira tri kriptirane datoteke na sustav. Jednu za \u0161irenje zlonamjernog k\u00f4da, druga za komunikaciju s Telegram botom i tre\u0107u za \u0161ifriranje datoteka i prikazivanje la\u017enog Windows a\u017euriranja.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19eba2dee8&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19eba2dee8\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/07\/image.png\" alt=\"\" class=\"wp-image-110963\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>BIg Head ransomware (izvor: Trend Micro)<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Svaka \u017ertva dobije jedinstveni ID koji se dohva\u0107a iz %appdata%\\\\ID direktorija ili se generira pomo\u0107u nasumi\u010dnog 40-znamenkastog niza znakova.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ransomware uklanja <em>shadow copies <\/em>kako bi onemogu\u0107io jednostavno vra\u0107anje sustava u stanje prije \u0161ifriranja, a presko\u010dit \u0107e \u0161ifriranje odre\u0111enih direktorija (npr. Windows, Recycle Bin, Program Files) kako bi sustav ipak ostao upotrebljiv.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ovaj ransomware provjerava je li pokrenut u virtualnom ra\u010dunalu te jezik sustava. Ransomware ne\u0107e kriptirati sustav ako je on postavljen na jedan od jezika biv\u0161ih zemalja \u010dlanica Sovjetskog saveza.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zanimljivo je \u0161to ovaj ransomware za vrijeme enkripcije prikazuje ekran koji korisniku sugerira da je u procesu nadogradnje Windows sustava.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19eba2e51b&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19eba2e51b\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/07\/image-1.png\" alt=\"\" class=\"wp-image-110964\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>La\u017eno a\u017euriranje Windows sustava (izvor: Trend Micro)<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Nakon zavr\u0161etka enkripcije, korisniku se na ekranu pojavljuje poruka s obavijesti o kompromitaciji sustava.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19eba2ea1d&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19eba2ea1d\" class=\"aligncenter size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/07\/image-2.png\" alt=\"\" class=\"wp-image-110965\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Poruka kompromitacije sustava (izvor: Trend Micro)<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Trend Micro zaklju\u010duje kako se ne radi o nekom sofisticiranom ransomwareu, jer su njegove tehnike enkripcije standardne te ga je lako primijetiti. <strong>Ali, fokus ovog ransomwarea je na korisnicima koji se daju zavarati jednostavnim tehnikama (kao \u0161to je prikazivanje la\u017enog Windows a\u017euriranja). <\/strong>\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vi\u0161e o Big Head ransomwareu pro\u010ditajte na:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/23\/g\/tailing-big-head-ransomware-variants-tactics-and-impact.html\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.trendmicro.com\/en_us\/research\/23\/g\/tailing-big-head-ransomware-variants-tactics-and-impact.html<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/fortiguard-labs-ransomware-roundup-big-headDok mislite da se va\u0161 sustav a\u017eurira, Big Head ransomware mo\u017eda kriptira va\u0161e podatke. Trend Micro je objavio tehni\u010dko izvje\u0161\u0107e o novom ransomwareu nazvanom 'Big Head', \u010dije je dvije, ranije ina\u010dice istra\u017eivao i Fortinet. Tvrde da sve tri ina\u010dice potje\u010du od istog aktera koji prilago\u0111ava pristup napada. Za vrijeme kriptiranja podataka korisniku na prikazuje la\u017eni proces a\u017euriranja Windowsa. Big Head je .NET binarna datoteka koja instalira tri kriptirane datoteke na sustav. Jednu za \u0161irenje zlonamjernog k\u00f4da, druga za komunikaciju s Telegram botom i tre\u0107u za \u0161ifriranje datoteka i prikazivanje la\u017enog Windows a\u017euriranja.    BIg Head ransomware (izvor: Trend Micro) Svaka \u017ertva dobije jedinstveni ID koji se dohva\u0107a iz %appdata%\\\\ID direktorija ili se generira pomo\u0107u nasumi\u010dnog 40-znamenkastog niza znakova.  Ransomware uklanja shadow copies kako bi onemogu\u0107io jednostavno vra\u0107anje sustava u stanje prije \u0161ifriranja, a presko\u010dit \u0107e \u0161ifriranje odre\u0111enih direktorija (npr. Windows, Recycle Bin, Program Files) kako bi sustav ipak ostao upotrebljiv. Ovaj ransomware provjerava je li pokrenut u virtualnom ra\u010dunalu te jezik sustava. Ransomware ne\u0107e kriptirati sustav ako je on postavljen na jedan od jezika biv\u0161ih zemalja \u010dlanica Sovjetskog saveza. Zanimljivo je \u0161to ovaj ransomware za vrijeme enkripcije prikazuje ekran koji korisniku sugerira da je u procesu nadogradnje Windows sustava.   La\u017eno a\u017euriranje Windows sustava (izvor: Trend Micro) Nakon zavr\u0161etka enkripcije, korisniku se na ekranu pojavljuje poruka s obavijesti o kompromitaciji sustava.    Poruka kompromitacije sustava (izvor: Trend Micro) Trend Micro zaklju\u010duje kako se ne radi o nekom sofisticiranom ransomwareu, jer su njegove tehnike enkripcije standardne te ga je lako primijetiti. Ali, fokus ovog ransomwarea je na korisnicima koji se daju zavarati jednostavnim tehnikama (kao \u0161to je prikazivanje la\u017enog Windows a\u017euriranja).   Vi\u0161e o Big Head ransomwareu pro\u010ditajte na: https:\/\/www.trendmicro.com\/en_us\/research\/23\/g\/tailing-big-head-ransomware-variants-tactics-and-impact.html  https:\/\/www.fortinet.com\/blog\/threat-research\/fortiguard-labs-ransomware-roundup-big-head\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.fortinet.com\/blog\/threat-research\/fortiguard-labs-ransomware-roundup-big-head<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Trend Micro je objavio tehni\u010dko izvje\u0161\u0107e o novom ransomwareu nazvanom &#8216;Big Head&#8217;, \u010dije je ranije ina\u010dice istra\u017eivao i Fortinet. Tvrde da sve tri ina\u010dice potje\u010du od istog aktera koji prilago\u0111ava pristup napada. Za vrijeme kriptiranja podataka korisniku na prikazuje la\u017eni proces a\u017euriranja Windowsa. Big Head je .NET binarna datoteka koja instalira tri kriptirane datoteke na [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1349,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-852","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=852"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/852\/revisions"}],"predecessor-version":[{"id":1351,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/852\/revisions\/1351"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1349"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=852"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=852"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}