Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\SYSTEM\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\dialmap.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\coffee.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\dashborder_96.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\dial.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\contosoroot.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\contoso.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\sdkfailsafeemulator.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\pmd.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\testee.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\hanni_umami_chapter.doc.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- <Drive name for removable media>:\adhd_and_obesity.docx.[prisoner1@tuta.io][zu7d0r6maq43veg].void
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MSDTC
- '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net.exe' stop vds
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\idk.txt
- %ALLUSERSPROFILE%\pubk.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\ose.exe.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- C:\bootnxt.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- C:\$recycle.bin\s-1-5-21-1004681136-874170566-1875838749-1001\desktop.ini.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- D:\install.log.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- D:\install.log
- C:\krd2018_data\legal notices\legal_notices.txt.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- D:\$recycle.bin\s-1-5-21-1004681136-874170566-1875838749-1001\desktop.ini.[prisoner1@tuta.io][zu7d0r6maq43veg].void
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.[prisoner1@tuta.io][zu7d0r6maq43veg].void
Modifies user data files (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- /ip-provider.php via sf###dev.org
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?75##############
HTTP POST requests
- /1614CEEEC50A9336EBF690886CAA747D6811C45D37086A3FA7B11C9E83926C6C via 94.##0.46.250
UDP
- DNS ASK go.microsoft.com
- DNS ASK share.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK sf###dev.org
- DNS ASK pa###bin.com
- DNS ASK maps.windows.com
- 'localhost':55361
- 'localhost':55355
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSDTC
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall set opmode mode=disable
- '<SYSTEM32>\devicecensus.exe' UserCxt
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\net1.exe' stop vds
- '%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\net1.exe' stop MSDTC
- '%WINDIR%\syswow64\cmd.exe' /c net stop vds
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1
