Ransom.Win32.RAPID.SM

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is capable of encrypting files in the affected system.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %Application Data%\info.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet
• "%System%\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No
• "%System%\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP
• "%System%\cmd.exe" /c wmic SHADOWCOPY DELETE
• "%System%\wbem\WMIC.exe" wmic SHADOWCOPY DELETE
• "%System%\schtasks.exe" /Create /SC MINUTE /TN Encrypter /TR %Application Data%\info.exe
• "%System%\schtasks.exe" /Create /SC ONLOGON /TN EncrypterSt /TR %Application Data%\info.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Encrypter_074 = %Application Data%\info.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
userinfo = %Application Data%\recovery.txt

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\EncryptKeys
local_enc_private_key_len = {Hex Values}

HKEY_CURRENT_USER\Software\EncryptKeys
local_enc_private_key = {Hex Values}

HKEY_CURRENT_USER\Software\EncryptKeys
local_public_key_len = {Hex Values}

HKEY_CURRENT_USER\Software\EncryptKeys
local_public_key = {Hex Values}

Other Details

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\EncryptKeys

It is capable of encrypting files in the affected system.

It adds the following scheduled tasks:

• Task Name: EncrypterSt
  Scheduled: On Logon of any user
  Task to be run: %Application Data%\info.exe
• Task Name: Encrypter
  Scheduled: Every minute
  Task to be run: %Application Data%\info.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .no_more_ransom

It drops the following file(s) as ransom note:

• {Encrypted Directory}\How Recovery Files.txt
• %Application Data%\recovery.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)