Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'MNZartugV' = '%APPDATA%\coronavirus.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Update Assistant' = '"%APPDATA%\winupas.exe" *'
Creates or modifies the following files
- <SYSTEM32>\tasks\jfgp7zj
- <SYSTEM32>\tasks\nyhhnkywfqce
Creates the following files on removable media
- <Drive name for removable media>:\я
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\notepad.exe
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\how to recover encrypted files.txt
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
Modifies file system
Creates the following files
- %TEMP%\kernal.exe
- %TEMP%\system.exe
- %APPDATA%\coronavirus.exe
- %APPDATA%\chost.exe
- %APPDATA%\curl.exe
- %APPDATA%\svchost.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\$tmp$001.exe
- %APPDATA%\winupas.exe
Deletes the following files
- %TEMP%\kernal.exe
- %TEMP%\system.exe
- %APPDATA%\coronavirus.exe
- %APPDATA%\chost.exe
- %APPDATA%\svchost.exe
- <Drive name for removable media>:\я
Substitutes the following files
- %APPDATA%\coronavirus.exe
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://ip###ger.org/1tqvp7
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK google-public-dns-a.google.com
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\kernal.exe' -s -pdfgsrdgersfgersfgrsdrg
- '%TEMP%\system.exe'
- '%TEMP%\system.exe' runas
- '%APPDATA%\chost.exe' -s -pdfgsrdgersfgersfgrsdrg
- '%APPDATA%\svchost.exe'
- '%TEMP%\$tmp$001.exe'
- '%APPDATA%\winupas.exe' *
- '%WINDIR%\syswow64\cmd.exe' /c copy /y "%TEMP%\system.exe" "%APPDATA%\coronavirus.exe"' (with hidden window)
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('system.exe');close()}catch(e){}},10);"' (with hidden window)
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('coronavirus.exe').Path;o.RegWrite('HKCU\\Software\\Mic...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy "%TEMP%\$TMP$001.exe" "%APPDATA%\winupas.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Windows Update Assistant" /t REG_SZ /F /D "\"%APPDATA%\winupas.exe\" *" ...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy /y "%TEMP%\system.exe" "%APPDATA%\coronavirus.exe"
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('system.exe');close()}catch(e){}},10);"
- '%WINDIR%\syswow64\mshta.exe' "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('coronavirus.exe').Path;o.RegWrite('HKCU\\Software\\Mic...
- '%WINDIR%\syswow64\cmd.exe' /c copy "%TEMP%\$TMP$001.exe" "%APPDATA%\winupas.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Windows Update Assistant" /t REG_SZ /F /D "\"%APPDATA%\winupas.exe\" *" ...
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Windows Update Assistant" /t REG_SZ /F /D "\"%APPDATA%\winupas.exe\" *"
