Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\february_catalogue__2015.doc.wncryt
- <Drive name for removable media>:\fi51.doc.wncryt
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\toolbar.bmp
Modifies file system
Creates the following files
- <Current directory>\b.wnry
- <Current directory>\c.wnry
- <Current directory>\msg\m_bulgarian.wnry
- <Current directory>\msg\m_chinese (simplified).wnry
- <Current directory>\msg\m_chinese (traditional).wnry
- <Current directory>\msg\m_croatian.wnry
- <Current directory>\msg\m_czech.wnry
- <Current directory>\msg\m_danish.wnry
- <Current directory>\msg\m_dutch.wnry
- <Current directory>\msg\m_english.wnry
- <Current directory>\msg\m_filipino.wnry
- <Current directory>\msg\m_finnish.wnry
- <Current directory>\msg\m_french.wnry
- <Current directory>\msg\m_german.wnry
- <Current directory>\msg\m_greek.wnry
- <Current directory>\msg\m_indonesian.wnry
- <Current directory>\msg\m_italian.wnry
- <Current directory>\msg\m_japanese.wnry
- <Current directory>\msg\m_korean.wnry
- <Current directory>\msg\m_latvian.wnry
- <Current directory>\msg\m_norwegian.wnry
- <Current directory>\msg\m_polish.wnry
- <Current directory>\msg\m_portuguese.wnry
- <Current directory>\msg\m_romanian.wnry
- <Current directory>\msg\m_russian.wnry
- <Current directory>\msg\m_slovak.wnry
- <Current directory>\msg\m_spanish.wnry
- <Current directory>\msg\m_swedish.wnry
- <Current directory>\msg\m_turkish.wnry
- <Current directory>\msg\m_vietnamese.wnry
- <Current directory>\r.wnry
- <Current directory>\t.wnry
- <Current directory>\taskdl.exe
- <Current directory>\taskse.exe
- <Current directory>\u.wnry
- <Current directory>\00000000.pky
- <Current directory>\00000000.eky
- <Current directory>\00000000.res
- <Current directory>\@wanadecryptor@.exe
- <Current directory>\32811756565639.bat
- <Current directory>\@please_read_me@.txt
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
- <Current directory>\m.vbs
- %HOMEPATH%\desktop\applicantform_en.doc.wncryt
- %HOMEPATH%\desktop\cveuropeo.doc.wncryt
- %HOMEPATH%\desktop\fi51.doc.wncryt
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt
- %HOMEPATH%\desktop\ovp25012015.doc.wncryt
- %HOMEPATH%\desktop\@please_read_me@.txt
- %HOMEPATH%\desktop\@wanadecryptor@.exe
- %HOMEPATH%\desktop\correct.avi.wncryt
- %HOMEPATH%\desktop\dashborder_96.bmp.wncryt
- %HOMEPATH%\desktop\dial.bmp.wncryt
- %HOMEPATH%\desktop\toolbar.bmp.wncryt
- <Current directory>\@wanadecryptor@.exe.lnk
Deletes the following files
- <Current directory>\m.vbs
Moves the following files
- from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
- from %HOMEPATH%\desktop\applicantform_en.doc.wncryt to %HOMEPATH%\desktop\applicantform_en.doc.wncry
- from %HOMEPATH%\desktop\cveuropeo.doc.wncryt to %HOMEPATH%\desktop\cveuropeo.doc.wncry
- from %HOMEPATH%\desktop\fi51.doc.wncryt to %HOMEPATH%\desktop\fi51.doc.wncry
- from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncry
- from %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt to %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncry
- from %HOMEPATH%\desktop\ovp25012015.doc.wncryt to %HOMEPATH%\desktop\ovp25012015.doc.wncry
- from %HOMEPATH%\desktop\correct.avi.wncryt to %HOMEPATH%\desktop\correct.avi.wncry
- from %HOMEPATH%\desktop\dashborder_96.bmp.wncryt to %HOMEPATH%\desktop\dashborder_96.bmp.wncry
- from %HOMEPATH%\desktop\dial.bmp.wncryt to %HOMEPATH%\desktop\dial.bmp.wncry
- from %HOMEPATH%\desktop\toolbar.bmp.wncryt to %HOMEPATH%\desktop\toolbar.bmp.wncry
Modifies the following files
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\toolbar.bmp
- <Drive name for removable media>:\february_catalogue__2015.doc
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
Creates and executes the following
- '<Current directory>\taskdl.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "<Full path to file>",1: >"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
- '%WINDIR%\syswow64\attrib.exe' +h .
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\cmd.exe' /c 32811756565639.bat
- '%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
- '%WINDIR%\syswow64\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "<Full path to file>",1: >"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
- '<Current directory>\taskdl.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c 32811756565639.bat' (with hidden window)
