Trojan.Encoder.10121

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\cmd.exe' /C del /Q /F "%TEMP%\sys1.tmp"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\DesktopOSIRIS.bmp
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome

Modifies file system:

Creates the following files:

<STUBS_DIR>\GVOnline\OSIRIS-4150.htm
<STUBS_DIR>\GVOnline\RYIIIQG3--60TE--NEN8--657FE478--CCC58298868C.osiris
C:\RYIIIQG3--60TE--NEN8--EBA02B1A--0A49502B25E6.osiris
<STUBS_DIR>\l2\RYIIIQG3--60TE--NEN8--86896DAD--06930B13A19A.osiris
<STUBS_DIR>\lin\OSIRIS-2303.htm
<STUBS_DIR>\lin\RYIIIQG3--60TE--NEN8--BF7EEC51--9EB25A1B32C3.osiris
<STUBS_DIR>\l2\OSIRIS-1a63.htm
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\OSIRIS-90d8.htm
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\OSIRIS-8df8.htm
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RYIIIQG3--60TE--NEN8--426E911D--F38F2516D3EC.osiris
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\OSIRIS-cf0e.htm
%HOMEPATH%\Cookies\RYIIIQG3--60TE--NEN8--1045E3A7--A678DAEC78C6.osiris
%HOMEPATH%\Local Settings\History\History.IE5\OSIRIS-d01c.htm
%HOMEPATH%\Local Settings\History\History.IE5\RYIIIQG3--60TE--NEN8--4FB8E74D--6355B318D287.osiris
%HOMEPATH%\Cookies\OSIRIS-2d98.htm
%TEMP%\<INETFILES>\Content.IE5\4LEPC3U1\desktop.ini
%TEMP%\<INETFILES>\Content.IE5\AMRP7QOH\desktop.ini
%TEMP%\<INETFILES>\Content.IE5\S2R8A3LU\desktop.ini
%TEMP%\Cookies\index.dat
%TEMP%\History\History.IE5\MSHist012017012720170128\index.dat
%TEMP%\History\History.IE5\desktop.ini
%TEMP%\History\History.IE5\index.dat
%TEMP%\<INETFILES>\Content.IE5\C12FSDU7\desktop.ini
%HOMEPATH%\SendTo\OSIRIS-66bb.htm
C:\Far2\PluginSDK\Headers.c\OSIRIS-68d7.htm
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\OSIRIS-67de.htm
%HOMEPATH%\DesktopOSIRIS.htm
%TEMP%\<INETFILES>\Content.IE5\desktop.ini
%TEMP%\<INETFILES>\Content.IE5\index.dat
%HOMEPATH%\DesktopOSIRIS.bmp
C:\OSIRIS-8fa6.htm
C:\Far2\Plugins\Colorer\hrc\OSIRIS-161e.htm
C:\Far2\Plugins\Colorer\hrc\auto\types\OSIRIS-00e7.htm
<STUBS_DIR>\OSIRIS-452a.htm
C:\Far2\Addons\OSIRIS-d565.htm
C:\Far2\Documentation\eng\OSIRIS-37c9.htm
C:\Far2\Addons\Colors\Custom Highlighting\OSIRIS-d40e.htm
C:\Far2\OSIRIS-3fb6.htm
C:\Far2\Plugins\ExtSearch\sources\OSIRIS-20f6.htm
%HOMEPATH%\Templates\OSIRIS-5b7a.htm
C:\Documents and Settings\Default User\Templates\OSIRIS-baa8.htm
C:\Far2\Plugins\ExtSearch\sources\RegExp\OSIRIS-781b.htm
C:\Far2\Addons\Colors\OSIRIS-66e9.htm
C:\Far2\Addons\Colors\Default Highlighting\OSIRIS-ec1c.htm
C:\Far2\PluginSDK\Headers.pas\OSIRIS-ba18.htm
C:\Documents and Settings\Default User\OSIRIS-fbf0.htm
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\OSIRIS-238a.htm
C:\Documents and Settings\Default User\Cookies\OSIRIS-d502.htm
C:\Documents and Settings\Default User\SendTo\OSIRIS-f944.htm
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RYIIIQG3--60TE--NEN8--C75CC326--9F46FCC63DB2.osiris
C:\Documents and Settings\LocalService\Cookies\OSIRIS-29b3.htm
C:\Documents and Settings\LocalService\Cookies\RYIIIQG3--60TE--NEN8--FE08B9BC--7675C664E38D.osiris
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\OSIRIS-16b1.htm
C:\Far2\Plugins\Colorer\OSIRIS-61fd.htm
C:\Far2\Documentation\rus\OSIRIS-aabb.htm
C:\Far2\Plugins\FTP\OSIRIS-4f38.htm
C:\Far2\Plugins\Colorer\hrd\OSIRIS-c5df.htm
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\OSIRIS-5a53.htm
C:\Far2\Plugins\7-Zip\OSIRIS-ce35.htm
C:\Far2\Plugins\ExtSearch\doc\OSIRIS-5a74.htm