Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\HPUENWJWCEIWKKR\shell\open\command] '' = '%TEMP%\nkJ710iv603IwKb.exe'
Creates the following files on removable media
- <Drive name for removable media>:\how to decrypt files.txt
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\archer.avi
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following user processes:
- servicec.exe
Modifies file system
Creates the following files
- %TEMP%\gbr.exe
- %TEMP%\tlf.js
- %TEMP%\setup.exe
- %TEMP%\servicec.exe
- %TEMP%\drv.vbs
- %TEMP%\dkb.vbs
- %TEMP%\hsua.dll
- %TEMP%\aes.dll
- %TEMP%\nkj710iv603iwkb.exe
Creates ransom message files (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://st####racy.host.sk/numcontrol49/bubaga.php
UDP
- DNS ASK st####racy.host.sk
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\tlf.js"
- '%TEMP%\gbr.exe' -ps52f5e8g5e9 -d%LOCALAPPDATA%\Temp
- '%TEMP%\servicec.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\drv.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\dkb.vbs"
- '%TEMP%\gbr.exe' -ps52f5e8g5e9 -d%LOCALAPPDATA%\Temp' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' shadowcopy delete /nointeractive' (with hidden window)
