Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Installers] 'ImagePath' = '<SYSTEM32>\Installers.exe -s'
Creates the following services
- 'Installers' <SYSTEM32>\Installers.exe -s
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi.tcwwasted_info
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.tcwwasted_info
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contoso_1.cer.tcwwasted_info
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.tcwwasted_info
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\default.bmp.tcwwasted_info
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.tcwwasted_info
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\508softwareandos.doc.tcwwasted_info
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\february_catalogue__2015.doc.tcwwasted_info
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contosoroot.cer.tcwwasted_info
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_192.bmp.tcwwasted_info
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\coffee.bmp.tcwwasted_info
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dialmap.bmp.tcwwasted_info
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\pmd.cer.tcwwasted_info
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_96.bmp.tcwwasted_info
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\join.avi.tcwwasted_info
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\000814251_video_01.avi.tcwwasted_info
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\hanni_umami_chapter.doc.tcwwasted_info
- <Drive name for removable media>:\hanni_umami_chapter.doc
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\installers
- %APPDATA%\installers:bin
- %WINDIR%\syswow64\installers.exe
- %WINDIR%\temp\lck.log
Sets the 'hidden' attribute to the following files
- %APPDATA%\installers
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%APPDATA%\installers:bin' -r
- '%WINDIR%\syswow64\installers.exe' -s
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\Installers.exe
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\Installers.exe /reset
