Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\EncriptIDfile\Shell\Open\Command] '' = '%WINDIR%\SysWOW64\mshta.exe "%C:\Decoder.hta"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Autorun.SQL' = '%WINDIR%\svhost.exe'
Creates the following files on removable media
- <Drive name for removable media>:\decoder.hta
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\wrar520.exe
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
Modifies file system
Creates the following files
- <Current directory>\decoder.hta
- %ProgramFiles(x86)%\mozilla thunderbird\decoder.hta
- %ProgramFiles(x86)%\internet explorer\decoder.hta
- D:\$recycle.bin\decoder.hta
- C:\totalcmd\decoder.hta
- C:\recovery\decoder.hta
- %PROGRAMDATA%\decoder.hta
- %ProgramFiles(x86)%\decoder.hta
- %ProgramFiles%\decoder.hta
- C:\perflogs\decoder.hta
- C:\documents and settings\decoder.hta
- C:\$recycle.bin\decoder.hta
- D:\decoder.hta
- C:\decoder.hta
- %WINDIR%\delog.bat
- %WINDIR%\svhost.exe
- %ProgramFiles(x86)%\windows defender\decoder.hta
- %ProgramFiles%\ashmaisv\decoder.hta
Sets the 'hidden' attribute to the following files
- %WINDIR%\svhost.exe
Moves the following files
- from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.[id]siqmaatx4yxd8lk0y[id]
- from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.[id]siqmaatx4yxd8lk0y[id]
- from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.[id]siqmaatx4yxd8lk0y[id]
- from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.[id]siqmaatx4yxd8lk0y[id]
- from %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles(x86)%\mozilla thunderbird\accessiblemarshal.dll.[id]siqmaatx4yxd8lk0y[id]
- from %ProgramFiles(x86)%\mozilla thunderbird\thunderbird.exe to %ProgramFiles(x86)%\mozilla thunderbird\thunderbird.exe.[id]siqmaatx4yxd8lk0y[id]
- from %ProgramFiles(x86)%\mozilla thunderbird\platform.ini to %ProgramFiles(x86)%\mozilla thunderbird\platform.ini.[id]siqmaatx4yxd8lk0y[id]
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
- '45.##6.108.36':2803
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\delog.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\delog.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe el
- '%WINDIR%\syswow64\wevtutil.exe' el
- '%WINDIR%\syswow64\wevtutil.exe' cl "Analytic"
- '%WINDIR%\syswow64\wevtutil.exe' cl "Application"
- '%WINDIR%\syswow64\wevtutil.exe' cl "DebugChannel"
- '%WINDIR%\syswow64\wevtutil.exe' cl "DirectShowFilterGraph"
- '%WINDIR%\syswow64\wevtutil.exe' cl "DirectShowPluginControl"
- '%WINDIR%\syswow64\wevtutil.exe' cl "EndpointMapper"
- '%WINDIR%\syswow64\wevtutil.exe' cl "ForwardedEvents"
- '%WINDIR%\syswow64\wevtutil.exe' cl "HardwareEvents"
- '%WINDIR%\syswow64\wevtutil.exe' cl "Internet Explorer"
- '%WINDIR%\syswow64\wevtutil.exe' cl "Key Management Service"
- '%WINDIR%\syswow64\wevtutil.exe' cl "MF_MediaFoundationDeviceProxy"
- '%WINDIR%\syswow64\wevtutil.exe' cl "Media Center"
