What is Arizona Ransomware?

Arizona ransomware is a type of malware that encrypts all the files in a computer until the user pays a ransom. The files are encrypted with a .AZ extension appended at the end of the file name. Arizona is delivered through a Win32 EXE file and has been spotted inside the following files and processes: ['explorer.exe', 'AZ(DANGEROUS).exe', 'ghmg6nc3w.dll', 'AZ(DANGEROUS).bin']

Once executed, Arizona ransomware will encrypt all the files on the system and append the .AZ extension to each filename. The ransomware will also create a file called "README.txt" which will contain instructions on how to decrypt the files. The user is instructed to send an email to the ransomware's author in order to obtain the decryption key.

What is Ransomware?

Ransomware is a type of malware that encrypts a user’s files and then demands a ransom to restore access to the files. The ransomware may also threaten to publish the files or sell them on the dark web if a ransom is not paid. Ransomware attacks are on the rise, and the damage can be devastating. The FBI recommends backing up your data, as there is no guarantee that paying the ransom will restore access to your data.

How Does Ransomware Spread?

Ransomware is typically distributed via email attachments, malicious websites, or social engineering. The ransomware payload is delivered and executed on the victim’s computer. The payload then encrypts files on the computer and demands a ransom to decrypt them.

Arizona Ransomware Capabilities

Arizona ransomware may use process injection techniques to evade process-based defenses as well as to elevate privileges. By injecting code into processes, the ransomware may gain access to the process's memory, system/network resources, and elevated privileges. This may allow the ransomware to evade detection and persist on the system. Arizona ransomware uses the Query Registry attack technique to gather information about the system, configuration and installed software. This information can help adversaries further their operations within a network. Arizona ransomware may use masquerading techniques to make its files appear legitimate or benign to users and security tools. It may also rename system utilities to evade security monitoring. Arizona ransomware uses Clipboard Data attack techniques to collect data stored in the clipboard from users copying information within or between applications.

Mitigations Against Arizona Ransomware

Arizona ransomware can be mitigated by some endpoint security solutions that can be configured to block process injection. Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM. Additionally, it is important to back up your data regularly and to keep your software up to date.

How to Protect Against Ransomware?

There are a couple of things you can do to protect yourself from ransomware. First, make sure you have backups of your data. This way, if you do get hit with ransomware, you can wipe your machine and restore your data from backup. Second, make sure you have security software on your computer. If a piece of ransomware gets through, you can use your antivirus to remove it. Third, don't click on anything you don't trust. This includes links, email attachments, and anything else. Finally, make sure you educate your employees on the do's and don'ts of the internet. This will help protect you from any phishing attacks that might come their way.

• Use reliable security software. 
• Don’t click on links or download attachments from suspicious emails. 
• Keep your operating system and software up to date. 
• Never share passwords with anyone. 
• Use strong passwords with different combinations of numbers, letters, and other characters.