Worm.Win32.WRAMPLYR.A

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• {Removable Drive}\$Recycle.bin\{360322e1-13ee-11e5-824f-dc9c5213ca21}\{Computer Name}.log
  • contains the ff gathered data:
  • Current Time
  • Computer name
  • Drive's USB Driver name
  • Direction of infection
• {Removable Drive}\$Recycle.bin.lnk

It adds the following processes:

• If OS is Windows NT or later:
  • "schtasks /create /sc MINUTE /mo 20 /tn ""GoogleUpdateTaskMachineUAS"" /tr ""regsvr32 /s \""%AppDataLocal%\Microsoft\Media Player\{Malware Name}\"" /i:\""-s\"" "" /F"
  • "schtasks /run /tn ""GoogleUpdateTaskMachineUAS"""
• "cmd.exe /c ping 127.0.0.1&del ""{Malware Path}\$Recycle.bin\{Malware Name}"""

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

If OS Version is earlier than Windows NT:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
wrapper.dll = regsvr32 /s "%AppDataLocal%\Microsoft\Media Player\wrapper.dll" /i:"-s"

Propagation

This Worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}\$Recycle.bin\wrapper.dll

Adware Routine

This Worm deletes itself after execution.

Other Details

This Worm does the following:

• It continues with routine if inside its following installation folder:
  • %AppDataLocal%\Microsoft\Media Player
  • {Removable Drive}\$Recycle.bin
  • {Malware path}\$Recycle.bin
• if "-s" parameter is NOT used it does the following:
  • Creates the following folders:
  • %AppDataLocal%\Microsoft\Media Player\{360322e1-13ee-11e5-824f-dc9c5213ca21}
  • %AppDataLocal%\Microsoft\Media Player\{5C29F891-91DD-4744-99CE-5D50E733BEA6}
  • Run BAT files found in %AppDataLocal%\Microsoft\Media Player\{5C29F891-91DD-4744-99CE-5D50E733BEA6}\
  • Searches for text files found in %AppDataLocal%\Microsoft\Media Player\{360322e1-13ee-11e5-824f-dc9c5213ca21}\ and does the following:
  • Encrypts found text files
  • Renames .txt files found to {original filepath and name}.{Computer Name}.{Current DateTime}
  • Looks for the following folders in removable drives where it transfers encrypted text files:
  • {Removable Drive}\$Recycle.bin\{360322e1-13ee-11e5-824f-dc9c5213ca21}

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It accepts the following parameters:

• -s -Does the following:
  • Transfers the following files from installation folder:
  • %AppDataLocal%\Microsoft\Media Player\{360322e1-13ee-11e5-824f-dc9c5213ca21}
  • %AppDataLocal%\Microsoft\Media Player\{5C29F891-91DD-4744-99CE-5D50E733BEA6}
  • %AppDataLocal%\Microsoft\Media Player\wrapper.dll <- self
  • %AppDataLocal%\Microsoft\Media Player\config.ini
  • To:
  • {Removable Drive}\$Recycle.bin\{360322e1-13ee-11e5-824f-dc9c5213ca21}
  • {removable drive}\$Recycle.bin\{5C29F891-91DD-4744-99CE-5D50E733BEA6}
  • {removable drive}\$Recycle.bin\wrapper.dll <- self
  • {removable drive}\$Recycle.bin\config.ini

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)