Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemreset.exe] 'Debugger' = 'msg * "Factory reset is disabled by policy"'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- Windows Recovery Environment (WinRE)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\\\""
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %TEMP%\onefile_4980_134121397622380564\main.dll
- %TEMP%\onefile_4980_134121397622380564\_bz2.pyd
- %TEMP%\onefile_4980_134121397622380564\_cffi_backend.pyd
- %TEMP%\onefile_4980_134121397622380564\_ctypes.pyd
- %TEMP%\onefile_4980_134121397622380564\_decimal.pyd
- %TEMP%\onefile_4980_134121397622380564\_hashlib.pyd
- %TEMP%\onefile_4980_134121397622380564\_lzma.pyd
- %TEMP%\onefile_4980_134121397622380564\_queue.pyd
- %TEMP%\onefile_4980_134121397622380564\_socket.pyd
- %TEMP%\onefile_4980_134121397622380564\_ssl.pyd
- %TEMP%\onefile_4980_134121397622380564\_tkinter.pyd
- %TEMP%\onefile_4980_134121397622380564\libcrypto-1_1.dll
- %TEMP%\onefile_4980_134121397622380564\libffi-7.dll
- %TEMP%\onefile_4980_134121397622380564\libssl-1_1.dll
- %TEMP%\onefile_4980_134121397622380564\python3.dll
- %TEMP%\onefile_4980_134121397622380564\python310.dll
- %TEMP%\onefile_4980_134121397622380564\pythoncom310.dll
- %TEMP%\onefile_4980_134121397622380564\pywintypes310.dll
- %TEMP%\onefile_4980_134121397622380564\select.pyd
- %TEMP%\onefile_4980_134121397622380564\tcl86t.dll
- %TEMP%\onefile_4980_134121397622380564\tk86t.dll
- %TEMP%\onefile_4980_134121397622380564\unicodedata.pyd
- %TEMP%\onefile_4980_134121397622380564\vcruntime140.dll
- %TEMP%\onefile_4980_134121397622380564\vcruntime140_1.dll
- %TEMP%\onefile_4980_134121397622380564\win32api.pyd
- %TEMP%\onefile_4980_134121397622380564\win32crypt.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_salsa20.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_aes.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_aesni.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_cbc.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_cfb.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_ctr.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_ecb.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_ocb.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\cipher\_raw_ofb.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_blake2s.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_md5.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_sha1.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_sha224.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_sha256.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_sha384.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_sha512.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_ghash_clmul.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_ghash_portable.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\hash\_keccak.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\protocol\_scrypt.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\util\_cpuid_c.pyd
- %TEMP%\onefile_4980_134121397622380564\crypto\util\_strxor.pyd
- %TEMP%\onefile_4980_134121397622380564\pil\_imaging.pyd
- %TEMP%\onefile_4980_134121397622380564\pil\_imagingcms.pyd
- %TEMP%\onefile_4980_134121397622380564\pil\_imagingft.pyd
- %TEMP%\onefile_4980_134121397622380564\pil\_imagingmath.pyd
- %TEMP%\onefile_4980_134121397622380564\pil\_imagingtk.pyd
- %TEMP%\onefile_4980_134121397622380564\pil\_webp.pyd
- %TEMP%\onefile_4980_134121397622380564\certifi\cacert.pem
- %TEMP%\onefile_4980_134121397622380564\charset_normalizer\md.pyd
- %TEMP%\onefile_4980_134121397622380564\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_4980_134121397622380564\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_4980_134121397622380564\nacl\_sodium.pyd
- %TEMP%\onefile_4980_134121397622380564\zstandard\_cffi.pyd
- %TEMP%\onefile_4980_134121397622380564\zstandard\backend_c.pyd
- <Current directory>\bg.png
- %TEMP%\ss_407.png
- C:\users\desktop.ini.nebula
- C:\users\default\ntuser.dat.nebula
- C:\users\default\ntuser.dat.log1.nebula
- C:\users\default\ntuser.dat.log2.nebula
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf.nebula
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms.nebula
- C:\users\default\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms.nebula
- C:\users\public\desktop.ini.nebula
- C:\users\public\accountpictures\desktop.ini.nebula
- C:\users\public\desktop\acrobat reader dc.lnk.nebula
- C:\users\public\desktop\desktop.ini.nebula
- C:\users\public\desktop\firefox.lnk.nebula
- C:\users\public\desktop\microsoft edge.lnk.nebula
- C:\users\public\desktop\mozilla thunderbird.lnk.nebula
- C:\users\public\desktop\opera.lnk.nebula
- C:\users\public\desktop\steam.lnk.nebula
- C:\users\public\documents\desktop.ini.nebula
- C:\users\public\downloads\desktop.ini.nebula
- C:\users\public\libraries\desktop.ini.nebula
- C:\users\public\libraries\recordedtv.library-ms.nebula
- C:\users\public\music\desktop.ini.nebula
- C:\users\public\pictures\desktop.ini.nebula
- C:\users\public\videos\desktop.ini.nebula
- %HOMEPATH%\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tm.blf.nebula
- %HOMEPATH%\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000001.regtrans-ms.nebula
- %HOMEPATH%\ntuser.dat{53b39e88-18c4-11ea-a811-000d3aa4692b}.tmcontainer00000000000000000002.regtrans-ms.nebula
- %HOMEPATH%\ntuser.ini.nebula
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.nebula
- %HOMEPATH%\3d objects\desktop.ini.nebula
- %HOMEPATH%\contacts\desktop.ini.nebula
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.nebula
- %HOMEPATH%\desktop\coffee.bmp.nebula
- %HOMEPATH%\desktop\dashborder_144.bmp.nebula
- %HOMEPATH%\desktop\default.bmp.nebula
- %HOMEPATH%\desktop\desktop.ini.nebula
- %HOMEPATH%\desktop\dial.bmp.nebula
- %HOMEPATH%\desktop\fi51.doc.nebula
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.nebula
- %HOMEPATH%\desktop\google chrome.lnk.nebula
- %HOMEPATH%\desktop\lisp_success.doc.nebula
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.nebula
- %HOMEPATH%\desktop\ovp25012015.doc.nebula
- %HOMEPATH%\desktop\telegram.lnk.nebula
- %HOMEPATH%\documents\desktop.ini.nebula
- %HOMEPATH%\downloads\desktop.ini.nebula
- %HOMEPATH%\favorites\bing.url.nebula
- %HOMEPATH%\favorites\desktop.ini.nebula
- %HOMEPATH%\favorites\links\desktop.ini.nebula
- %HOMEPATH%\links\desktop.ini.nebula
- %HOMEPATH%\links\desktop.lnk.nebula
- %HOMEPATH%\links\downloads.lnk.nebula
- %HOMEPATH%\music\desktop.ini.nebula
- %HOMEPATH%\pictures\desktop.ini.nebula
- %HOMEPATH%\pictures\camera roll\desktop.ini.nebula
- %HOMEPATH%\saved games\desktop.ini.nebula
- %HOMEPATH%\searches\desktop.ini.nebula
- %HOMEPATH%\searches\everywhere.search-ms.nebula
- %HOMEPATH%\searches\indexed locations.search-ms.nebula
- %HOMEPATH%\searches\winrt--{s-1-5-21-4226853953-3309226944-3078887307-1000}-.searchconnector-ms.nebula
- %HOMEPATH%\videos\desktop.ini.nebula
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini.nebula
- %HOMEPATH%\desktop\readme.txt
Modifies the following files
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ap#.##legram.org':443
TCP
Other
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\README.txt
- '<SYSTEM32>\cmd.exe' /c "reagentc /disable"
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c "reagentc /disable"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"' (with hidden window)