Ransom.Win32.RAPID.WL

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Application Data%\{BLOCKED}l@{BLOCKED}019.com.url
• {Encrypted Directory}:\{BLOCKED}l@{BLOCKED}019.com.url

It drops the following copies of itself into the affected system:

• %Application Data%\info.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• vssadmin.exe Delete Shadows /All /Quiet
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• wbadmin DELETE SYSTEMSTATEBACKUP
• wmic SHADOWCOPY DELETE

It leaves text files that serve as ransom notes containing the following:

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• GUESSWHOBITCH

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Encrypter_074 = %ApplicationData%\info.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CUrrentVersion\Run
userinfo = %ApplciationData%\recovery.txt

Other System Modifications

This Ransomware adds the following registry keys:

HKEY_CURRENT_USER\Software\EncryptKeys

It adds the following registry entries:

HKEY_CURRENT_USER\Software\EncryptKeys
local_enc_private_key_len = "{Hex Data}"

HKEY_CURRENT_USER\Software\EncryptKeys
local_enc_private_key = "{Hex Data}"

HKEY_CURRENT_USER\Software\EncryptKeys
local_public_key_len = "{Hex Data}"

HKEY_CURRENT_USER\Software\EncryptKeys
local_public_key = "{Hex Data}"

HKEY_USERS\{ID}_CLASSES\.guesswho\
shell\open\command

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlplussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautoupds.exe
• agntsvc.exe
• agntsvc.exe
• agntsvc.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• steam.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• taskmgr.exe
• CMD.EXE

Other Details

This Ransomware does the following:

• Renames encrypted files with:
  {Encoded String}.guesswho

It adds the following scheduled tasks:

• Task Name: Encrypter
  Schedule: {Installation Time}, repeat every minute
  Task to be run: %Application Data%\info.exe
• Task Name: EncrypterSt
  Schedule: At Logon of any user
  Task to be run: %Application Data%\info.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• Windows
• Intel
• Nvidia
• Programdata
• Temp

It drops the following file(s) as ransom note:

• %Application Data%\recovery.txt
• {Encrypted Directory}:\How Recovery Files.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)