Trojan.Encoder.36097

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '"%WINDIR%\Edge.exe"'

Creates or modifies the following files

%WINDIR%\taskse.exe
<SYSTEM32>\tasks\update

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

%WINDIR%\chrome.exe
%HOMEPATH%\desktop\168.jpg.wncryt
%HOMEPATH%\desktop\168.jpeg.wncryt
%HOMEPATH%\desktop\13.jpeg.wncryt
%HOMEPATH%\desktop\1189.jpeg.wncryt
%WINDIR%\@please_read_me@.txt
%WINDIR%\163891666067109.bat
%WINDIR%\@wanadecryptor@.exe
%WINDIR%\00000000.res
%WINDIR%\00000000.eky
%WINDIR%\00000000.pky
%WINDIR%\u.wnry
%WINDIR%\taskdl.exe
%WINDIR%\t.wnry
%WINDIR%\s.wnry
%WINDIR%\r.wnry
%WINDIR%\msg\m_vietnamese.wnry
%WINDIR%\msg\m_turkish.wnry
%HOMEPATH%\desktop\2.jpeg.wncryt
%HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt
%APPDATA%\memz.exe
<Current directory>\x
<Current directory>\z.zip
%WINDIR%\@wanadecryptor@.exe.lnk
%TEMP%\idk.properties.resources.resources
%TEMP%\idk.binaries.rtkbtmanserv.exe
%TEMP%\idk.binaries.config
nul
%HOMEPATH%\desktop\@wanadecryptor@.exe
%HOMEPATH%\desktop\@please_read_me@.txt
%HOMEPATH%\desktop\weeklysheet1215.doc.wncryt
%HOMEPATH%\desktop\sdszfo.docx.wncryt
%HOMEPATH%\desktop\ovp25012015.doc.wncryt
%WINDIR%\m.vbs
%HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt
<Current directory>\x.js
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt
%HOMEPATH%\desktop\fi51.doc.wncryt
%WINDIR%\msg\m_swedish.wnry
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncryt
%WINDIR%\msg\m_spanish.wnry
%WINDIR%\msg\m_czech.wnry
%WINDIR%\msg\m_chinese (traditional).wnry
%WINDIR%\msg\m_chinese (simplified).wnry
%WINDIR%\msg\m_bulgarian.wnry
%WINDIR%\c.wnry
%WINDIR%\b.wnry
%WINDIR%\wannacrypt0r.exe
%TEMP%\綳凲蒠愓璮崅於囵肗炉絥迋桱闈擖頳.exe
%WINDIR%\noescape.exe
%TEMP%\綳凲蒠愓璮崅於囵肗炉絥迋桱闈擖頳.txt
%WINDIR%\monoxidex86.exe
%WINDIR%\memz-destructive.bat
%WINDIR%\memz-destructive.exe
%TEMP%\秧炭阙勅鼨灺帱总圞杜穤泜鎍芓吱齾.exe
%TEMP%\秧炭阙勅鼨灺帱总圞杜穤泜鎍芓吱齾.txt
%WINDIR%\pcfukckerxzz.exe
%WINDIR%\monoxidex64.exe
%WINDIR%\edge.exe
%WINDIR%\msg\m_croatian.wnry
%WINDIR%\msg\m_danish.wnry
%WINDIR%\msg\m_russian.wnry
%WINDIR%\msg\m_dutch.wnry
%WINDIR%\msg\m_romanian.wnry
%WINDIR%\msg\m_portuguese.wnry
%WINDIR%\msg\m_polish.wnry
%WINDIR%\msg\m_norwegian.wnry
%WINDIR%\msg\m_latvian.wnry
%WINDIR%\msg\m_korean.wnry
%TEMP%\質悳跽筺蚯艋綾魛岣婔岪怪开懤蒁澕.exe
%WINDIR%\msg\m_japanese.wnry
%TEMP%\質悳跽筺蚯艋綾魛岣婔岪怪开懤蒁澕.txt
%WINDIR%\msg\m_italian.wnry
%WINDIR%\msg\m_indonesian.wnry
%WINDIR%\msg\m_greek.wnry
%WINDIR%\msg\m_german.wnry
%WINDIR%\msg\m_french.wnry
%WINDIR%\msg\m_finnish.wnry
%WINDIR%\msg\m_filipino.wnry
%WINDIR%\msg\m_english.wnry
%WINDIR%\msg\m_slovak.wnry
%WINDIR%\syswow64\system\secure system.exe

Sets the 'hidden' attribute to the following files

%TEMP%\秧炭阙勅鼨灺帱总圞杜穤泜鎍芓吱齾.exe
%TEMP%\綳凲蒠愓璮崅於囵肗炉絥迋桱闈擖頳.exe
%TEMP%\質悳跽筺蚯艋綾魛岣婔岪怪开懤蒁澕.exe
%WINDIR%\syswow64\system\secure system.exe

Deletes the following files

%TEMP%\秧炭阙勅鼨灺帱总圞杜穤泜鎍芓吱齾.txt
%WINDIR%\monoxidex64.exe
%TEMP%\綳凲蒠愓璮崅於囵肗炉絥迋桱闈擖頳.txt
%TEMP%\質悳跽筺蚯艋綾魛岣婔岪怪开懤蒁澕.txt
%WINDIR%\monoxidex86.exe
%WINDIR%\m.vbs
<Current directory>\x.js
<Current directory>\z.zip
<Current directory>\x

Moves the following files

from %HOMEPATH%\desktop\1189.jpeg.wncryt to %HOMEPATH%\desktop\1189.jpeg.wncry
from %HOMEPATH%\desktop\13.jpeg.wncryt to %HOMEPATH%\desktop\13.jpeg.wncry
from %HOMEPATH%\desktop\168.jpeg.wncryt to %HOMEPATH%\desktop\168.jpeg.wncry
from %HOMEPATH%\desktop\168.jpg.wncryt to %HOMEPATH%\desktop\168.jpg.wncry
from %HOMEPATH%\desktop\2.jpeg.wncryt to %HOMEPATH%\desktop\2.jpeg.wncry
from %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncry
from %HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt to %HOMEPATH%\desktop\adhd_and_obesity.docx.wncry
from %HOMEPATH%\desktop\fi51.doc.wncryt to %HOMEPATH%\desktop\fi51.doc.wncry
from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncry
from %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt to %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncry
from %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt to %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncry
from %HOMEPATH%\desktop\ovp25012015.doc.wncryt to %HOMEPATH%\desktop\ovp25012015.doc.wncry
from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
from %HOMEPATH%\desktop\weeklysheet1215.doc.wncryt to %HOMEPATH%\desktop\weeklysheet1215.doc.wncry

Modifies the following files

%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Substitutes the following files

%WINDIR%\monoxidex64.exe

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'ip##pi.com':80

TCP

HTTP GET requests

http://ip##pi.com/json/

UDP

DNS ASK ip##pi.com

Miscellaneous

Creates and executes the following

'%TEMP%\綳凲蒠愓璮崅於囵肗炉絥迋桱闈擖頳.exe'
'%WINDIR%\taskdl.exe'
'%WINDIR%\wannacrypt0r.exe'
'%WINDIR%\syswow64\system\secure system.exe'
'%WINDIR%\memz-destructive.exe'
'%WINDIR%\monoxidex86.exe'
'%APPDATA%\memz.exe'
'%TEMP%\質悳跽筺蚯艋綾魛岣婔岪怪开懤蒁澕.exe'
'%WINDIR%\monoxidex64.exe'
'%WINDIR%\edge.exe'
'%WINDIR%\chrome.exe'
'%WINDIR%\pcfukckerxzz.exe'
'%WINDIR%\noescape.exe'
'%TEMP%\秧炭阙勅鼨灺帱总圞杜穤泜鎍芓吱齾.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGYAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAeQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
'%WINDIR%\monoxidex86.exe' ' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c 163891666067109.bat' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
'%WINDIR%\noescape.exe' ' (with hidden window)
'%WINDIR%\taskdl.exe' ' (with hidden window)
'%WINDIR%\memz-destructive.exe' ' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGwAZQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAdgBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
'%WINDIR%\pcfukckerxzz.exe' ' (with hidden window)
'%WINDIR%\monoxidex64.exe' ' (with hidden window)
'%WINDIR%\edge.exe' ' (with hidden window)
'%WINDIR%\chrome.exe' ' (with hidden window)
'%WINDIR%\wannacrypt0r.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\MEMZ-Destructive.bat" "' (with hidden window)
'<SYSTEM32>\schtasks.exe' /create /tn "WINDOWSSYSTEMHOST" /tr "%WINDIR%\SysWOW64\System\Secure System.exe" /sc MINUTE /MO 1' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGYAbABxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAeQBuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGwAZQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAdgBoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\MEMZ-Destructive.bat" "
'%WINDIR%\syswow64\attrib.exe' +h .
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
'%WINDIR%\syswow64\cmd.exe' /c 163891666067109.bat
'%WINDIR%\syswow64\cscript.exe' x.js
'%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
'<SYSTEM32>\schtasks.exe' /create /tn "Update" /sc ONLOGON /tr "%WINDIR%\Edge.exe" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Update" /sc ONLOGON /tr "%WINDIR%\SysWOW64\System\Secure System.exe" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WINDOWSSYSTEMHOST" /tr "%WINDIR%\SysWOW64\System\Secure System.exe" /sc MINUTE /MO 1

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial