Trojan.Encoder.32640

To ensure autorun and distribution

Sets the following service settings

Creates the following files on removable media

<Drive name for removable media>:\delete.avi.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\dialmap.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\coffee.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\dashborder_96.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\dial.bmp.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\contosoroot.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\contoso.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\sdkfailsafeemulator.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\pmd.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\testee.cer.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\hanni_umami_chapter.doc.[prisoner1@tuta.io][zu7d0r6maq43veg].void
<Drive name for removable media>:\adhd_and_obesity.docx.[prisoner1@tuta.io][zu7d0r6maq43veg].void

Malicious functions

Executes the following

Injects code into

the following system processes:

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\idk.txt
%ALLUSERSPROFILE%\pubk.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\ose.exe.[prisoner1@tuta.io][zu7d0r6maq43veg].void
C:\bootnxt.[prisoner1@tuta.io][zu7d0r6maq43veg].void
C:\$recycle.bin\s-1-5-21-1004681136-874170566-1875838749-1001\desktop.ini.[prisoner1@tuta.io][zu7d0r6maq43veg].void
D:\install.log.[prisoner1@tuta.io][zu7d0r6maq43veg].void
D:\install.log
C:\krd2018_data\legal notices\legal_notices.txt.[prisoner1@tuta.io][zu7d0r6maq43veg].void
D:\$recycle.bin\s-1-5-21-1004681136-874170566-1875838749-1001\desktop.ini.[prisoner1@tuta.io][zu7d0r6maq43veg].void
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml.[prisoner1@tuta.io][zu7d0r6maq43veg].void

Modifies user data files (Trojan.Encoder).

Network activity

TCP

HTTP GET requests

/ip-provider.php via sf###dev.org
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?75##############

HTTP POST requests

/1614CEEEC50A9336EBF690886CAA747D6811C45D37086A3FA7B11C9E83926C6C via 94.##0.46.250

'localhost':49693

'localhost':49695

'localhost':49696

'pa###bin.com':443

UDP

Miscellaneous

Searches for the following windows

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop MSDTC
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\net1.exe' stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall set opmode mode=disable
'<SYSTEM32>\devicecensus.exe' UserCxt
'%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set currentprofile state off
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$CONTOSO1
'%WINDIR%\syswow64\net1.exe' stop vds
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER
'%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c wbadmin delete catalog -quiet
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled no
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\net1.exe' stop MSDTC
'%WINDIR%\syswow64\cmd.exe' /c net stop vds
'%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1