Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SpeakerLocker' = '"%APPDATA%\GreenNatureSoft\Speaker Locker\Speaker Locker.exe" -startup'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\GreenNatureSoft\Speaker Locker\gns_maintain.exe' Speaker<space>Locker.exe
- '%APPDATA%\GreenNatureSoft\Speaker Locker\gns_volhost.exe' -gurdian Speaker<space>Locker.exe
- '%APPDATA%\GreenNatureSoft\Speaker Locker\Speaker Locker.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding A7C7B738A5D047C11CBBDDE9F8BAADDF
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i "%APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\speaker_locker.msi" AI_SETUPEXEPATH=<Full path to virus> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
Modifies file system :
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI6.tmp
- C:\Config.Msi\20b63.rbs
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\AI_ResourceCleanerLog.txt
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %TEMP%\~DF7D10.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIB.tmp
- %APPDATA%\Microsoft\Installer\{5ACA03D6-F6AD-4D5C-B293-994D8DECBDF5}\SpeakerAdmin.exe
- %WINDIR%\Installer\20b64.msi
- %APPDATA%\GreenNatureSoft\Speaker Locker\gns_maintain.exe
- %APPDATA%\GreenNatureSoft\Speaker Locker\gns_volhost.exe
- %TEMP%\~DF7E00.tmp
- %HOMEPATH%\Desktop\Speaker Locker.lnk
- %WINDIR%\Installer\MSIA.tmp
- %TEMP%\AIBB_3068.tmp
- %TEMP%\{10E2DEC4-BF64-4BEB-A0A3-C35B6E52993F}.bat
- %HOMEPATH%\Start Menu\Programs\Speaker Locker\Speaker Locker.lnk
- %APPDATA%\GreenNatureSoft\Speaker Locker\Speaker Locker.exe
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\Speaker Locker.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\MSI2.tmp
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\speaker_locker.aiui
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\speaker_locker.msi
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\decoder.dll
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\20b60.msi
- %TEMP%\1f97e.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\20b62.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
Sets the 'hidden' attribute to the following files:
- %APPDATA%\GreenNatureSoft\Speaker Locker\gns_volhost.exe
Deletes the following files:
- %WINDIR%\Installer\20b60.msi
- %WINDIR%\Installer\20b62.ipi
- %WINDIR%\Installer\MSIB.tmp
- C:\Config.Msi\20b63.rbs
- %TEMP%\1f97e.msi
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\Speaker Locker.exe
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\speaker_locker.aiui
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\decoder.dll
- %APPDATA%\GreenNatureSoft\Speaker Locker 1.0.0\install\DECBDF5\speaker_locker.msi
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI9.tmp
Network activity:
Connects to:
- 'gr####aturesoft.com':80
TCP:
HTTP GET requests:
- gr####aturesoft.com/update/speaker_locker/update.php?vs##
- gr####aturesoft.com/activation/nausage.php?pi#######################################################################################################################################################################
- gr####aturesoft.com/activation/get_price.php?pi###
UDP:
- DNS ASK gr####aturesoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
