Trojan.Encoder.31706

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\pushkin.jpg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\toolbar.bmp

Searches for windows to

detect analytical utilities:

ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: 'RegmonClass', WindowName: ''

Modifies file system

Creates the following files

<Current directory>\b.wnry
<Current directory>\r.wnry
<Current directory>\s.wnry
<Current directory>\t.wnry
<Current directory>\taskdl.exe
<Current directory>\taskse.exe
<Current directory>\u.wnry
<Current directory>\00000000.pky
<Current directory>\00000000.eky
<Current directory>\00000000.res
<Current directory>\@wanadecryptor@.exe
<Current directory>\75211588401652.bat
<Current directory>\@please_read_me@.txt
%HOMEPATH%\desktop\1189.jpg.wncryt
%HOMEPATH%\desktop\13.jpeg.wncryt
%HOMEPATH%\desktop\168.jpg.wncryt
%HOMEPATH%\desktop\210252809.jpeg.wncryt
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncryt
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
%HOMEPATH%\desktop\applicantform_en.doc.wncryt
%HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wncryt
%HOMEPATH%\desktop\pushkin.jpeg.wncryt
%HOMEPATH%\desktop\pushkin.jpg.wncryt
%HOMEPATH%\desktop\@please_read_me@.txt
<Current directory>\msg\m_vietnamese.wnry
%HOMEPATH%\desktop\@wanadecryptor@.exe
<Current directory>\msg\m_turkish.wnry
<Current directory>\msg\m_spanish.wnry
<Current directory>\c.wnry
<Current directory>\msg\m_bulgarian.wnry
<Current directory>\msg\m_chinese (simplified).wnry
<Current directory>\msg\m_chinese (traditional).wnry
<Current directory>\msg\m_croatian.wnry
<Current directory>\msg\m_czech.wnry
<Current directory>\msg\m_danish.wnry
<Current directory>\msg\m_dutch.wnry
<Current directory>\msg\m_english.wnry
<Current directory>\msg\m_filipino.wnry
<Current directory>\msg\m_finnish.wnry
<Current directory>\msg\m_french.wnry
<Current directory>\msg\m_german.wnry
<Current directory>\msg\m_greek.wnry
<Current directory>\msg\m_indonesian.wnry
<Current directory>\msg\m_italian.wnry
<Current directory>\msg\m_japanese.wnry
<Current directory>\msg\m_korean.wnry
<Current directory>\msg\m_latvian.wnry
<Current directory>\msg\m_norwegian.wnry
<Current directory>\msg\m_polish.wnry
<Current directory>\msg\m_portuguese.wnry
<Current directory>\msg\m_romanian.wnry
<Current directory>\msg\m_russian.wnry
<Current directory>\msg\m_slovak.wnry
<Current directory>\msg\m_swedish.wnry
<Current directory>\m.vbs

Deletes the following files

<Drive name for removable media>:\ovp25012015.doc.wncryt
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.wncryt
<Drive name for removable media>:\nwfieldnotes1966.docx.wncryt

Moves the following files

from %HOMEPATH%\desktop\1189.jpg.wncryt to %HOMEPATH%\desktop\1189.jpg.wncry
from %HOMEPATH%\desktop\13.jpeg.wncryt to %HOMEPATH%\desktop\13.jpeg.wncry
from %HOMEPATH%\desktop\168.jpg.wncryt to %HOMEPATH%\desktop\168.jpg.wncry
from %HOMEPATH%\desktop\210252809.jpeg.wncryt to %HOMEPATH%\desktop\210252809.jpeg.wncry
from %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncry
from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
from %HOMEPATH%\desktop\applicantform_en.doc.wncryt to %HOMEPATH%\desktop\applicantform_en.doc.wncry
from %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt to %HOMEPATH%\desktop\february_catalogue__2015.doc.wncry
from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncry
from %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wncryt to %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wncry
from %HOMEPATH%\desktop\pushkin.jpeg.wncryt to %HOMEPATH%\desktop\pushkin.jpeg.wncry
from %HOMEPATH%\desktop\pushkin.jpg.wncryt to %HOMEPATH%\desktop\pushkin.jpg.wncry

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''

Creates and executes the following

'<Current directory>\taskdl.exe'
'%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
'<Current directory>\taskdl.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c 75211588401652.bat' (with hidden window)

Executes the following