RANSOM_WINBAM.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %AppDataLocal%\Temp\VSD{4 random chars}.tmp\install.log <- installation log
• %AppDataLocal%\Temp\VSD{4 random chars}.tmp\afterreboot.cfg
• %AppDataLocal%\Temp\VSD{4 random chars}.tmp\setup.exe <- copy of itself
• %AppDataLocal%\Temp\VSD{4 random chars}.tmp\DotNetFX461\NDP461-KB3102438-Web.exe <- installs .NET Framework
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\manifests\winb...exe_{16 random chars}_0001.0000_none_{16 random chars}.cdf-ms
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\manifests\winb...exe_{16 random chars}_0001.0000_none_{16 random chars}.manifest
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\manifests\winb..tion_{16 random chars}_0001.0000_none_{16 random chars}.cdf-ms
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\manifests\winb..tion_{16 random chars}_0001.0000_none_{16 random chars}.manifest
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb...exe_{16 random chars}_0001.0000_none_{16 random chars}\WinBamboozle.exe.config
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\WinBamboozle.cdf-ms
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\WinBamboozle.exe
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\WinBamboozle.exe.cdf-ms
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\WinBamboozle.exe.config
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\WinBamboozle.exe.manifest
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\WinBamboozle.manifest
• %AppDataLocal%\Temp\ASPNETSetup_00000.log
• %AppDataLocal%\Temp\dd_NDP461-KB3102438-Web_decompression_log.txt
• %AppDataLocal%\Temp\dd_SetupUtility.txt
• %AppDataLocal%\Temp\dd_TMPC356.tmp_decompression_log.txt
• %AppDataLocal%\Temp\dd_wcf_CA_smci_20180612_001709_686.txt
• %AppDataLocal%\Temp\Deployment\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}.application
• %AppDataLocal%\Temp\Deployment\{8 random chars}.{3 random chars}\WinBamboozle.exe.manifest

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %AppDataLocal%\Temp\Deployment
• %AppDataLocal%\Temp\Deployment\{8 random chars}.{3 random chars}
• %AppDataLocal%\Apps
• %AppDataLocal%\Apps\2.0
• %AppDataLocal%\Apps\2.0\Data
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\manifests
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb...exe_{16 random chars}_0001.0000_none_{16 random chars}
• %AppDataLocal%\Apps\2.0\Data\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\Data
• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}
• %AppDataLocal%\Temp\VSD{4 random chars}.tmp
• %AppDataLocal%\Temp\VSD{4 random chars}.tmp\DotNetFX461

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Download Routine

This Ransomware accesses the following websites to download files:

• http://download.microsoft.com/download/3/5/9/35980F81-60F4-4DE3-88FC-8F962B97253B/NDP461-KB3102438-Web.exe <- non-malicious file, it is executed to ensure that the malware runs in the proper .NET Framework

Other Details

This Ransomware connects to the following URL(s) to check for an Internet connection:

• http://go.microsoft.com/

It does the following:

• This malware is a ZIP file containing the following files:
  
  • {malware extraction path}\full\Application Files
  • {malware extraction path}\full\Application Files\WinBamboozle_1_0_0_0
  • {malware extraction path}\full\Application Files\WinBamboozle_1_0_0_0\WinBamboozle.application
  • {malware extraction path}\full\Application Files\WinBamboozle_1_0_0_0\WinBamboozle.exe.config.deploy
  • {malware extraction path}\full\Application Files\WinBamboozle_1_0_0_0\WinBamboozle.exe.deploy
  • {malware extraction path}\full\Application Files\WinBamboozle_1_0_0_0\WinBamboozle.exe.manifest
  • {malware extraction path}\full\Test
  • {malware extraction path}\full\Test\data.txt
  • {malware extraction path}\full\setup.exe
  • {malware extraction path}\full\WinBambozzle.application
• It requires reboot after installation
  
• The malware is still in development and only encrypt files found in %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\Test displaying a command prompt during encryption
  

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\Test

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It appends the following extension to the file name of the encrypted files:

• .{5 random chars}

It drops the following file(s) as ransom note:

• %AppDataLocal%\Apps\2.0\{8 random chars}.{3 random chars}\{8 random chars}.{3 random chars}\winb..tion_{16 random chars}_0001.0000_{16 random chars}\Test\_README.txt