Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\fltsrv] 'ImagePath' = 'System32\drivers\fltsrv.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\fltsrv] 'Start' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\snapman] 'ImagePath' = 'System32\drivers\snapman.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\snapman] 'Start' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker] 'ImagePath' = 'System32\drivers\volume_tracker.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker] 'Start' = '00000000'
Creates the following services
- 'fltsrv' System32\drivers\fltsrv.sys
- 'snapman' System32\drivers\snapman.sys
- 'volume_tracker' System32\drivers\volume_tracker.sys
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\mouse.com
- %TEMP%\7zipsfx.000\system32\drivers\snapman.sys
- %TEMP%\7zipsfx.000\system32\drivers\volume_tracker.sys
- %TEMP%\7zipsfx.000\system32\snapapi.dll
- %TEMP%\7zipsfx.000\system32\volume_tracker_driver_api.dll
- %TEMP%\7zipsfx.000\thread_pool.dll
- %TEMP%\7zipsfx.000\tib_api.dll
- %TEMP%\7zipsfx.000\tib_mounter.dll
- %TEMP%\7zipsfx.000\trueimage.exe
- %TEMP%\7zipsfx.000\ulxmlrpcpp.dll
- %TEMP%\7zipsfx.000\vccorlib120.dll
- %TEMP%\7zipsfx.000\winpthreads4.dll
- %TEMP%\7zipsfx.000\wnaspi32.dll
- %TEMP%\7zipsfx.000\zstd.dll
- %TEMP%\ebe4.tmp\ebe5.tmp\ebe6.bat
- <DRIVERS>\fltsrv.sys
- %WINDIR%\temp\uddf372.tmp
- <DRIVERS>\snapman.sys
- <SYSTEM32>\snapapi.dll
- %WINDIR%\temp\uddfcc6.tmp
- <DRIVERS>\volume_tracker.sys
- <SYSTEM32>\volume_tracker_driver_api.dll
- %WINDIR%\temp\udd39a.tmp
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-journal
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-shm
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-wal
- %ALLUSERSPROFILE%\acronis\snapapilogs\snapapi-20240112-002235-912.0.log
- %TEMP%\7zipsfx.000\system32\drivers\fltsrv.sys
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db-journal
- %TEMP%\7zipsfx.000\rpc_client.dll
- %TEMP%\7zipsfx.000\readcd.exe
- %TEMP%\7zipsfx.000\archive3.dll
- %TEMP%\7zipsfx.000\archive3_adapter.dll
- %TEMP%\7zipsfx.000\astor_client.dll
- %TEMP%\7zipsfx.000\atilauncher.exe
- %TEMP%\7zipsfx.000\backup_worker.exe
- %TEMP%\7zipsfx.000\boot_assist.dll
- %TEMP%\7zipsfx.000\cdrecord2.exe
- %TEMP%\7zipsfx.000\curl.dll
- %TEMP%\7zipsfx.000\disk_backup.dll
- %TEMP%\7zipsfx.000\expat.dll
- %TEMP%\7zipsfx.000\file_backup.dll
- %TEMP%\7zipsfx.000\fox.dll
- %TEMP%\7zipsfx.000\growisofs.exe
- %TEMP%\7zipsfx.000\icu38.dll
- %TEMP%\7zipsfx.000\icudt38.dll
- %TEMP%\7zipsfx.000\kb_link.dll
- %TEMP%\7zipsfx.000\libcrypto10.dll
- %TEMP%\7zipsfx.000\libqrencode.dll
- %TEMP%\7zipsfx.000\libssl10.dll
- %TEMP%\7zipsfx.000\logging.dll
- %TEMP%\7zipsfx.000\mspack.dll
- %TEMP%\7zipsfx.000\msvcp120.dll
- %TEMP%\7zipsfx.000\msvcr120.dll
- %TEMP%\7zipsfx.000\oem_doc_source.dll
- %TEMP%\7zipsfx.000\onig.dll
- %TEMP%\7zipsfx.000\pcs_io.dll
- %TEMP%\7zipsfx.000\re2.dll
- %TEMP%\7zipsfx.000\resource.dll
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db
Deletes the following files
- %WINDIR%\temp\uddf372.tmp
- %WINDIR%\temp\uddfcc6.tmp
- %WINDIR%\temp\udd39a.tmp
- %TEMP%\ebe4.tmp\ebe5.tmp\ebe6.bat
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-journal
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db-journal
Substitutes the following files
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db-journal
Miscellaneous
Searches for the following windows
- ClassName: 'TRUEIMAGE_DUMMY_APPLICATION_WINDOW' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\atilauncher.exe'
- '%TEMP%\7zipsfx.000\trueimage.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EBE4.tmp\EBE5.tmp\EBE6.bat %TEMP%\7ZipSfx.000\ATILauncher.exe"' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EBE4.tmp\EBE5.tmp\EBE6.bat %TEMP%\7ZipSfx.000\ATILauncher.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "" "
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} /f /v UpperFilters /t REG_MULTI_SZ /d "fltsrv"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\TrueImage /f /v standard /t REG_SZ /d " 19109 19 30 18 27108108120 6 31 96 30 20 25 7 97120109108 16 30 18 23 31108120103 4 29 97 27 29 13 97120 30 2...
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\TrueImageHome\Settings /f /v ServiceDir /t REG_SZ /d "
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\GlobalComponents /f /v snapapi.dll /t REG_SZ /d "<SYSTEM32>\snapapi.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\GlobalComponents /f /v volume_tracker_driver_api.dll /t REG_SZ /d "<SYSTEM32>\volume_tracker_driver_api.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v archive3.dll /t REG_SZ /d "archive3.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v archive3_adapter.dll /t REG_SZ /d "archive3_adapter.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v astor_client.dll /t REG_SZ /d "astor_client.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v boot_assist.dll /t REG_SZ /d "boot_assist.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v disk_backup.dll /t REG_SZ /d "disk_backup.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v expat.dll /t REG_SZ /d "expat.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v file_backup.dll /t REG_SZ /d "file_backup.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v icu38.dll /t REG_SZ /d "icu38.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v libcrypto10.dll /t REG_SZ /d "libcrypto10.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v zstd.dll /t REG_SZ /d "zstd.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v libssl10.dll /t REG_SZ /d "libssl10.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v logging.dll /t REG_SZ /d "logging.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v mspack.dll /t REG_SZ /d "mspack.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v oem_doc_source.dll /t REG_SZ /d "oem_doc_source.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v onig.dll /t REG_SZ /d "onig.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v pcs_io.dll /t REG_SZ /d "pcs_io.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v re2.dll /t REG_SZ /d "re2.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v resource.dll /t REG_SZ /d "resource.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v rpc_client.dll /t REG_SZ /d "rpc_client.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v thread_pool.dll /t REG_SZ /d "thread_pool.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v tib_api.dll /t REG_SZ /d "tib_api.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v tib_mounter.dll /t REG_SZ /d "tib_mounter.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v ulxmlrpcpp.dll /t REG_SZ /d "ulxmlrpcpp.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v winpthreads4.dll /t REG_SZ /d "winpthreads4.dll"
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} /v UpperFilters
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v kb_link.dll /t REG_SZ /d "kb_link.dll"
- '<SYSTEM32>\cmd.exe' /c reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} /v UpperFilters
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v Start /t REG_DWORD /d 0
- '<SYSTEM32>\sc.exe' query fltsrv
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v DisplayName /t REG_SZ /d "Acronis Storage Filter Management"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\fltsrv.sys
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v ErrorControl /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Start /t REG_DWORD /d 0
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Type /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Group /t REG_SZ /d "PnP Filter"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Tag /t REG_DWORD /d 8
- '<SYSTEM32>\sc.exe' create fltsrv type= kernel start= boot binpath= System32\drivers\fltsrv.sys
- '<SYSTEM32>\sc.exe' start fltsrv
- '<SYSTEM32>\sc.exe' query snapman
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v DisplayName /t REG_SZ /d "Acronis Snapshot Manager"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\snapman.sys
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v ErrorControl /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v Type /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "PartMgr" "
- '<SYSTEM32>\sc.exe' create snapman type= kernel start= boot binpath= System32\drivers\snapman.sys
- '<SYSTEM32>\sc.exe' start snapman
- '<SYSTEM32>\sc.exe' query volume_tracker
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v DisplayName /t REG_SZ /d "Acronis Volume Tracker"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\volume_tracker.sys
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v ErrorControl /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v Start /t REG_DWORD /d 0
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v Type /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v Group /t REG_SZ /d "PnP Filter"
- '<SYSTEM32>\sc.exe' create volume_tracker type= kernel start= boot binpath= System32\drivers\volume_tracker.sys
- '<SYSTEM32>\sc.exe' start volume_tracker
- '<SYSTEM32>\cmd.exe' /c reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
- '<SYSTEM32>\findstr.exe' /i fltsrv
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /f /v UpperFilters /t REG_MULTI_SZ /d "PartMgr\0fltsrv"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v backup_worker.exe /t REG_SZ /d "backup_worker.exe"
