Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'StartupKey' = '"%APPDATA%\StartupKey.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'i9IQ0' = '%APPDATA%\qSdec\i9IQ0.exe'
Infects the following executable files:
- C:\Far2\Far.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '%TEMP%\GRIEVE CRYPTER RELEASE.EXE'
- '%TEMP%\AUDACITY.EXE'
Executes the following:
- '%TEMP%\AUDACITY.EXE'
- '%WINDIR%\svchost.com' "%TEMP%\3582-490\GRIEVE~1.EXE"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
- '<SYSTEM32>\notepad.exe'
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
the following user processes:
- AUDACITY.EXE
Modifies file system:
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001101.exe
- %WINDIR%\directx.sys
- %WINDIR%\svchost.com
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001210.exe
- %TEMP%\tmp5023.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\A0001856.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\A0001213.exe
- %TEMP%\3582-490\GRIEVE CRYPTER RELEASE.EXE
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
- %APPDATA%\qSdec\i9IQ0.exe
- %TEMP%\AUDACITY.EXE
- %TEMP%\GRIEVE CRYPTER RELEASE.EXE
- %APPDATA%\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.new
- %APPDATA%\StartupKey.exe
Deletes the following files:
- %TEMP%\3582-490\GRIEVE CRYPTER RELEASE.EXE
- %WINDIR%\svchost.com
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.3012.151343
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.3012.151359
Moves the following files:
- from %APPDATA%\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.new to %APPDATA%\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.3012.151359
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.3012.151343
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
Network activity:
Connects to:
- 'gr#####s.duckdns.org':1999
UDP:
- DNS ASK gr#####s.duckdns.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
