Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\svhost
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %APPDATA%\svhost.exe
- z:\bootsect.bak
- z:\recovery_instructions.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\recovery_instructions.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\recovery_instructions.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\users\default\appdata\roaming\microsoft\windows\sendto\recovery_instructions.html
- %HOMEPATH%\desktop\recovery_instructions.html
- %HOMEPATH%\favorites\links\recovery_instructions.html
- %HOMEPATH%\favorites\links for united states\recovery_instructions.html
- %HOMEPATH%\favorites\microsoft websites\recovery_instructions.html
- %HOMEPATH%\favorites\msn websites\recovery_instructions.html
- C:\users\default\recovery_instructions.html
- %HOMEPATH%\contacts\recovery_instructions.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- z:\boot\bcd.log1
- z:\boot\recovery_instructions.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\recovery_instructions.html
- z:\boot\bcd.log2
- z:\boot\bootstat.dat
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- z:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\desktop.ini
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\recovery_instructions.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\recovery_instructions.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\recovery_instructions.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\recovery_instructions.html
- %HOMEPATH%\favorites\windows live\recovery_instructions.html
- %HOMEPATH%\searches\recovery_instructions.html
Moves the following files
- from z:\boot\bcd.log1 to z:\boot\bcd.log1.nett
- from z:\boot\bcd.log2 to z:\boot\bcd.log2.nett
- from z:\boot\bootstat.dat to z:\boot\bootstat.dat.nett
- from z:\bootsect.bak to z:\bootsect.bak.nett
Modifies the following files
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\microsoft.vc90.crt.manifest
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.117.1':445
- '<LOCALNET>.117.1':139
Miscellaneous
Creates and executes the following
- '%APPDATA%\svhost.exe'
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\taskeng.exe' {F4705601-021E-4F85-A33B-7A3ADAE0CA22} S-1-5-21-3150914307-1777937420-491476919-1000:ohdlpnhmex\user:Interactive:[1]
- '%APPDATA%\svhost.exe' ' (with hidden window)
