Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Dnscache] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\FDResPub] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\SSDPSRV] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\upnphost] 'Start' = '00000002'
Creates the following files on removable media
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM RaccineSettings.exe
- '%WINDIR%\syswow64\taskkill.exe' /IM outlook.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM dbeng50.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM dbsnmp.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM excel.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mbamtray.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM tmlisten.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM thebat64.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM xfssvccon.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM CNTAoSMgr.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-nt.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM sqlbrowser.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM zoolz.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM wordpad.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-opt.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM ocautoupds.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM winword.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM ocssd.exe /F
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
- '%WINDIR%\syswow64\taskkill.exe' /IM oracle.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM sqlagent.exe /F
- '%WINDIR%\syswow64\taskkill.exe' IM thunderbird.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM visio.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM powerpnt.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM firefoxconfig.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mspub.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM synctime.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopqos.exe /F
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
- '%WINDIR%\syswow64\taskkill.exe' /IM Ntrtscan.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopservice.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM sqbcoreservice.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM agntsvc.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM isqlplussvc.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mysqld.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM tbirdconfig.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM onenote.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM thebat.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM PccNTMon.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM steam.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM sqlwriter.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM msftesql.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM msaccess.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM ocomm.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM encsvc.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM infopath.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F
Modifies file system
Creates the following files
- %TEMP%\go-memexec-307802647.exe
- unc\waghlo*\mailslot\net\netlogon
Substitutes the following files
- %ALLUSERSPROFILE%\Microsoft\Windows\Caches\cversions.2.db
- %ALLUSERSPROFILE%\Microsoft\Windows\Caches\{0C3336A4-5EF7-463B-ACCA-2CB87C52F88C}.2.ver0x0000000000000001.db
- %ALLUSERSPROFILE%\Microsoft\Windows\Caches\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db
- %ALLUSERSPROFILE%\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db
- %ALLUSERSPROFILE%\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db
Changes user data files extensions (Trojan.Encoder).
Network activity
UDP
- 'localhost':49246
- 'localhost':55812
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\go-memexec-307802647.exe'
Executes the following
- '%WINDIR%\syswow64\reg.exe' delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Raccine /F
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "Raccine Rules Updater" /F
- '%WINDIR%\syswow64\sc.exe' config Dnscache start= auto
- '%WINDIR%\syswow64\sc.exe' config SQLTELEMETRY start= disabled
- '%WINDIR%\syswow64\sc.exe' config FDResPub start= auto
- '%WINDIR%\syswow64\sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled
- '%WINDIR%\syswow64\sc.exe' config SSDPSRV start= auto
- '%WINDIR%\syswow64\sc.exe' config SstpSvc start= disabled
- '%WINDIR%\syswow64\sc.exe' config SQLWriter start= disabled
- '%WINDIR%\syswow64\sc.exe' config upnphost start= auto
- '%WINDIR%\syswow64\arp.exe' -a
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
