Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\decrypt-files.txt
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\toolbar.bmp
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\vssvc.exe
- %ALLUSERSPROFILE%\microsoft\ilscache\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft\office\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft\rac\statedata\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\decrypt-files.txt
- %ALLUSERSPROFILE%\microsoft toolkit\decrypt-files.txt
- %ALLUSERSPROFILE%\mozilla\logs\decrypt-files.txt
- %ALLUSERSPROFILE%\sun\java\java update\decrypt-files.txt
- C:\users\public\pictures\sample pictures\decrypt-files.txt
- C:\users\public\videos\sample videos\decrypt-files.txt
- %HOMEPATH%\desktop\decrypt-files.txt
- D:\decrypt-files.txt
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml
- C:\users\public\pictures\sample pictures\lighthouse.jpg
- C:\users\public\pictures\sample pictures\koala.jpg
- C:\users\public\pictures\sample pictures\jellyfish.jpg
- C:\users\public\pictures\sample pictures\hydrangeas.jpg
- C:\users\public\pictures\sample pictures\desert.jpg
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg
- %ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml
- %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-uninstall.log
- %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-install.log
- %ALLUSERSPROFILE%\microsoft toolkit\settings.xml
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.dat
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.dat
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.dat
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.dat
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr1.dat
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr0.dat
- %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml
- C:\users\public\pictures\sample pictures\penguins.jpg
- C:\users\public\pictures\sample pictures\tulips.jpg
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%TEMP%\vssvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SubmitSamplesConsent NeverSend' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -MAPSReporting Disable' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SubmitSamplesConsent NeverSend
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -MAPSReporting Disable
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force
