Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\fbbd1e-readme.txt
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\trivial-merge.html
Modifies file system
Creates the following files
- %TEMP%\kanzzwux.0.cs
- %LOCALAPPDATA%\msfree inc\fbbd1e-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\fbbd1e-readme.txt
- %HOMEPATH%\contacts\fbbd1e-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\fbbd1e-readme.txt
- %HOMEPATH%\desktop\fbbd1e-readme.txt
- %HOMEPATH%\fbbd1e-readme.txt
- C:\far2\documentation\eng\fbbd1e-readme.txt
- C:\far2\encyclopedia\fbbd1e-readme.txt
- C:\far2\documentation\rus\fbbd1e-readme.txt
- D:\fbbd1e-readme.txt
- C:\users\public\libraries\fbbd1e-readme.txt
- C:\far2\fbbd1e-readme.txt
- %TEMP%\res367a.tmp
- %TEMP%\csc366a.tmp
- %TEMP%\xmx68uud.out
- %TEMP%\xmx68uud.cmdline
- %TEMP%\xmx68uud.0.cs
- %TEMP%\kanzzwux.dll
- %TEMP%\res330f.tmp
- %TEMP%\csc32ff.tmp
- %TEMP%\kanzzwux.out
- %TEMP%\kanzzwux.cmdline
- %TEMP%\xmx68uud.dll
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\fbbd1e-readme.txt
Deletes the following files
- %TEMP%\res330f.tmp
- %TEMP%\csc32ff.tmp
- %TEMP%\kanzzwux.pdb
- %TEMP%\kanzzwux.0.cs
- %TEMP%\kanzzwux.dll
- %TEMP%\kanzzwux.out
- %TEMP%\kanzzwux.cmdline
- %TEMP%\res367a.tmp
- %TEMP%\csc366a.tmp
- %TEMP%\xmx68uud.out
- %TEMP%\xmx68uud.cmdline
- %TEMP%\xmx68uud.0.cs
- %TEMP%\xmx68uud.dll
- %TEMP%\xmx68uud.pdb
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.fbbd1e
- from %ProgramFiles%\microsoft office\document themes 14\waveform.thmx to %ProgramFiles%\microsoft office\document themes 14\waveform.thmx.fbbd1e
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kanzzwux.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES330F.tmp" "%TEMP%\CSC32FF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xmx68uud.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES367A.tmp" "%TEMP%\CSC366A.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kanzzwux.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES330F.tmp" "%TEMP%\CSC32FF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xmx68uud.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES367A.tmp" "%TEMP%\CSC366A.tmp"
- '<SYSTEM32>\vssvc.exe'
