Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system' = '%TEMP%\gbs1vgat.tw1\Endermanch@Birele.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%TEMP%\gbs1vgat.tw1\Endermanch@Birele.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\Web\rundll32.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'AVPCC' = '%WINDIR%\Cursors\avp.exe'
- [<HKCU>\software\microsoft\windows\currentversion\run] 'NQIowoIE.exe' = '%HOMEPATH%\TAIQYAIA\NQIowoIE.exe'
- [<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'nMssMsYA.exe' = '%ALLUSERSPROFILE%\aaksokIw\nMssMsYA.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\cscc] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\cscc] 'ImagePath' = 'cscc.dat'
Creates the following services
- 'cscc' cscc.dat
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- System Restore (SR)
modifies the following system settings:
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyPictures' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMyMusic' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyDocs' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000414'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoToolbarCustomize' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinterTabs' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinters' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyPictures' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMyMusic' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyDocs' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '00000414'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoToolbarCustomize' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinterTabs' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoPrinters' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000001'
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\netsh.exe
Modifies settings of Windows Internet Explorer
- [<HKLM>\Software\Wow6432Node\Microsoft\Internet Explorer\Main] 'Window title' = ':::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::'
- [<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window title' = ':::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- <Current directory>\badrabbit.zip
- <Current directory>\polyransom.zip
- %TEMP%\jcxrwheq.k3o\endermanch@polyransom.exe
- %WINDIR%\temp\udd3a8.tmp
- %WINDIR%\4ef.tmp
- <Current directory>\winlocker.vb6.blacksod.zip
- %HOMEPATH%\taiqyaia\nqiowoie
- %ALLUSERSPROFILE%\aaksokiw\nmssmsya
- %ALLUSERSPROFILE%\aaksokiw\nmssmsya.exe
- %TEMP%\36d1130a\ac2e.tmp
- %TEMP%\cyoogemy.bat
- %TEMP%\jcxrwheq.k3o\endermanch@polyransom
- %TEMP%\zoz3sp02.pgy\endermanch@winlockervb6blacksod.exe
- %TEMP%\weimwuwc.bat
- %ALLUSERSPROFILE%\aaksokiw\nmssmsya.inf
- %HOMEPATH%\taiqyaia\nqiowoie.inf
- %TEMP%\36d1130a\44f7.tmp
- %TEMP%\mojnsbwj.hj0\endermanch@petya.a.exe
- %HOMEPATH%\taiqyaia\nqiowoie.exe
- <Current directory>\petya.a.zip
- %TEMP%\ouawizny.cv0\endermanch@derialock.exe
- %TEMP%\ldo5gt42.ge3\endermanch@badrabbit.exe
- <Current directory>\birele.zip
- %TEMP%\gbs1vgat.tw1\endermanch@birele.exe
- %WINDIR%\infpub.dat
- <Current directory>\cerber 5.zip
- %TEMP%\tbwhs3ec.x11\endermanch@cerber5.exe
- <Current directory>\derialock.zip
- <Current directory>\fantom.zip
- <Current directory>\nomoreransom.zip
- %TEMP%\ka0p4tso.b54\fantom.exe
- <Current directory>\infinitycrypt.zip
- %TEMP%\kf1j41oo.igr\endermanch@infinitycrypt.exe
- <Current directory>\krotten.zip
- %TEMP%\tosyzryk.ojp\endermanch@krotten.exe
- %WINDIR%\cscc.dat
- %WINDIR%\dispci.exe
- %TEMP%\3qixylrf.nbm\endermanch@nomoreransom.exe
- <Current directory>\windows\csrss.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\taiqyaia\nqiowoie.exe
- %ALLUSERSPROFILE%\aaksokiw\nmssmsya.exe
Deletes the following files
- <Current directory>\badrabbit.zip
- <Current directory>\birele.zip
- <Current directory>\cerber 5.zip
- <Current directory>\derialock.zip
- <Current directory>\fantom.zip
- <Current directory>\infinitycrypt.zip
- <Current directory>\krotten.zip
- %WINDIR%\infpub.dat
- <Current directory>\nomoreransom.zip
- <Current directory>\petya.a.zip
- <Current directory>\polyransom.zip
- %WINDIR%\temp\udd3a8.tmp
- %TEMP%\cyoogemy.bat
- <Current directory>\winlocker.vb6.blacksod.zip
- <Current directory>\windows\csrss.exe
- %WINDIR%\4ef.tmp
Network activity
Connects to
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- '<LOCALNET>.51.0':445
- '<LOCALNET>.51.0':139
- '<LOCALNET>.51.1':445
- '<LOCALNET>.51.1':139
- '<LOCALNET>.51.2':445
- '<LOCALNET>.51.2':139
- '<LOCALNET>.51.3':445
TCP
Other
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Program Manager'
- ClassName: '' WindowName: 'Äèñïåò÷åð çà äà ÷ Windows'
- ClassName: '' WindowName: 'Çà ïóñê ïðîãðà ììû'
- ClassName: '' WindowName: 'Ìîé êîìïüþòåð'
- ClassName: '' WindowName: 'ÂûïîëГГЁГІГј'
- ClassName: '' WindowName: 'windowssecurity'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\ldo5gt42.ge3\endermanch@badrabbit.exe'
- '%TEMP%\tosyzryk.ojp\endermanch@krotten.exe'
- '%ALLUSERSPROFILE%\aaksokiw\nmssmsya.exe'
- '%HOMEPATH%\taiqyaia\nqiowoie.exe'
- '%WINDIR%\4ef.tmp' \\.\pipe\{E1253F66-538A-4B33-8047-C3AC1239E6F9}
- '%TEMP%\mojnsbwj.hj0\endermanch@petya.a.exe'
- '%TEMP%\jcxrwheq.k3o\endermanch@polyransom.exe'
- '%TEMP%\3qixylrf.nbm\endermanch@nomoreransom.exe'
- '%TEMP%\ka0p4tso.b54\fantom.exe'
- '%TEMP%\ouawizny.cv0\endermanch@derialock.exe'
- '%TEMP%\tbwhs3ec.x11\endermanch@cerber5.exe'
- '%TEMP%\gbs1vgat.tw1\endermanch@birele.exe'
- '%TEMP%\kf1j41oo.igr\endermanch@infinitycrypt.exe'
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' %WINDIR%\infpub.dat,#1 15
- '%WINDIR%\syswow64\cmd.exe' schtasks /Delete /F /TN rhaegal
- '%WINDIR%\syswow64\cmd.exe' schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "<SYSTEM32>\cmd.exe /C Start \"\" \"%WINDIR%\dispci.exe\" -id 2530964786 && exit"
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN rhaegal
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state on
- '%WINDIR%\syswow64\cmd.exe' schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "<SYSTEM32>\shutdown.exe /r /t 0 /f" /ST 00:26:00
- '%WINDIR%\syswow64\netsh.exe' advfirewall reset
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\jcxrwheq.k3o\Endermanch@PolyRansom"
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
- '%WINDIR%\syswow64\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "<SYSTEM32>\cmd.exe /C Start \"\" \"%WINDIR%\dispci.exe\" -id 2530964786 && exit"
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\WEIMwUwc.bat" "%TEMP%\jcxrwheq.k3o\Endermanch@PolyRansom.exe""
- '%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC once /TN drogon /RU SYSTEM /TR "<SYSTEM32>\shutdown.exe /r /t 0 /f" /ST 00:26:00