Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSFEEditor' = '"<Full path to file>" e'
Creates the following files on removable media
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\february_catalogue__2015.doc.inprocess
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc.inprocess
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\contoso.cer.inprocess
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\pmd.cer.inprocess
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contosoroot.cer.inprocess
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contosoroot_1.cer.inprocess
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\contoso_1.cer.inprocess
- <Drive name for removable media>:\applicantform_en.doc.inprocess
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\testcertificate.cer.inprocess
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\dashborder_144.bmp.inprocess
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_96.bmp.inprocess
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\coffee.bmp.inprocess
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dialmap.bmp.inprocess
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\000814251_video_01.avi.inprocess
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\join.avi.inprocess
- <Drive name for removable media>:\testee.cer.inprocess
- <Drive name for removable media>:\cveuropeo.doc
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Injects code into
the following system processes:
- <SYSTEM32>\vssvc.exe
Modifies file system
Creates the following files
- %APPDATA%\key.file
- %HOMEPATH%\desktop\recovery_instructions.txt
- g:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- %WINDIR%\logs\windowsbackup\wbadmin.0.etl
- C:\recovery_instructions.txt
- C:\users\public\desktop\recovery_instructions.txt
- D:\recovery_instructions.txt
- g:\bootmgr.inprocess
- g:\bootsect.bak.inprocess
- g:\xeldz.inprocess
Sets the 'hidden' attribute to the following files
- g:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- g:\bootmgr.readinstructions
- g:\bootsect.bak.readinstructions
- g:\xeldz.readinstructions
Moves the following files
- from %WINDIR%\logs\windowsbackup\wbadmin.0.etl to %WINDIR%\logs\windowsbackup\wbadmin.1.etl
- from g:\bootmgr.inprocess to g:\bootmgr.readinstructions
- from g:\bootsect.bak.inprocess to g:\bootsect.bak.readinstructions
- from g:\xeldz.inprocess to g:\xeldz.readinstructions
- from %ProgramFiles(x86)%\mozilla firefox\precomplete to %ProgramFiles(x86)%\mozilla firefox\precomplete.inprocess
- from %ProgramFiles(x86)%\mozilla firefox\precomplete.inprocess to %ProgramFiles(x86)%\mozilla firefox\precomplete.readinstructions
- from %ProgramFiles(x86)%\mozilla firefox\removed-files to %ProgramFiles(x86)%\mozilla firefox\removed-files.inprocess
- from %ProgramFiles(x86)%\mozilla firefox\removed-files.inprocess to %ProgramFiles(x86)%\mozilla firefox\removed-files.readinstructions
- from %ProgramFiles(x86)%\mozilla thunderbird\precomplete to %ProgramFiles(x86)%\mozilla thunderbird\precomplete.inprocess
- from %ProgramFiles(x86)%\mozilla thunderbird\precomplete.inprocess to %ProgramFiles(x86)%\mozilla thunderbird\precomplete.readinstructions
- from %ProgramFiles(x86)%\mozilla thunderbird\removed-files to %ProgramFiles(x86)%\mozilla thunderbird\removed-files.inprocess
- from %ProgramFiles(x86)%\mozilla thunderbird\removed-files.inprocess to %ProgramFiles(x86)%\mozilla thunderbird\removed-files.readinstructions
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.inprocess
- from %ProgramFiles(x86)%\opera\server_tracking_data.inprocess to %ProgramFiles(x86)%\opera\server_tracking_data.readinstructions
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
- '<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
