Trojan.Encoder.30875

Technical Information

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\split.avi

Modifies file system

Creates the following files

%WINDIR%\microsoft.net\framework\v2.0.50727\b.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\r.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\s.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\t.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\taskdl.exe
%WINDIR%\microsoft.net\framework\v2.0.50727\taskse.exe
%WINDIR%\microsoft.net\framework\v2.0.50727\u.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\00000000.pky
%WINDIR%\microsoft.net\framework\v2.0.50727\00000000.eky
%WINDIR%\microsoft.net\framework\v2.0.50727\00000000.res
%WINDIR%\microsoft.net\framework\v2.0.50727\@wanadecryptor@.exe
%WINDIR%\microsoft.net\framework\v2.0.50727\205231580428196.bat
%WINDIR%\microsoft.net\framework\v2.0.50727\@please_read_me@.txt
%HOMEPATH%\desktop\1189.jpeg.wncryt
%HOMEPATH%\desktop\2.jpeg.wncryt
%HOMEPATH%\desktop\3.jpeg.wncryt
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt
%HOMEPATH%\desktop\508softwareandos.doc.wncryt
%HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wncryt
%HOMEPATH%\desktop\parnas_01.jpeg.wncryt
%HOMEPATH%\desktop\@please_read_me@.txt
%HOMEPATH%\desktop\@wanadecryptor@.exe
%HOMEPATH%\desktop\000814251_video_01.avi.wncryt
%HOMEPATH%\desktop\archer.avi.wncryt
%HOMEPATH%\desktop\correct.avi.wncryt
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_vietnamese.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\m.vbs
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_turkish.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_spanish.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\c.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_bulgarian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_chinese (simplified).wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_chinese (traditional).wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_croatian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_czech.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_danish.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_dutch.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_english.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_filipino.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_finnish.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_french.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_german.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_greek.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_indonesian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_italian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_japanese.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_korean.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_latvian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_norwegian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_polish.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_portuguese.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_romanian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_russian.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_slovak.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\msg\m_swedish.wnry
%WINDIR%\microsoft.net\framework\v2.0.50727\@wanadecryptor@.exe.lnk

Deletes the following files

<Drive name for removable media>:\lisp_success.doc.wncryt
%WINDIR%\microsoft.net\framework\v2.0.50727\m.vbs
<Drive name for removable media>:\fi51.doc.wncryt

Moves the following files

from %HOMEPATH%\desktop\1189.jpeg.wncryt to %HOMEPATH%\desktop\1189.jpeg.wncry
from %HOMEPATH%\desktop\2.jpeg.wncryt to %HOMEPATH%\desktop\2.jpeg.wncry
from %HOMEPATH%\desktop\3.jpeg.wncryt to %HOMEPATH%\desktop\3.jpeg.wncry
from %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncry
from %HOMEPATH%\desktop\508softwareandos.doc.wncryt to %HOMEPATH%\desktop\508softwareandos.doc.wncry
from %HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt to %HOMEPATH%\desktop\adhd_and_obesity.docx.wncry
from %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wncryt to %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wncry
from %HOMEPATH%\desktop\parnas_01.jpeg.wncryt to %HOMEPATH%\desktop\parnas_01.jpeg.wncry
from %HOMEPATH%\desktop\000814251_video_01.avi.wncryt to %HOMEPATH%\desktop\000814251_video_01.avi.wncry
from %HOMEPATH%\desktop\archer.avi.wncryt to %HOMEPATH%\desktop\archer.avi.wncry
from %HOMEPATH%\desktop\correct.avi.wncryt to %HOMEPATH%\desktop\correct.avi.wncry

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\taskdl.exe'
'%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
'%WINDIR%\microsoft.net\framework\v2.0.50727\taskdl.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c 205231580428196.bat' (with hidden window)

Executes the following