Trojan.Encoder.7122

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\tomcat

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\MpsSvcc] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\MpsSvcc] 'ImagePath' = '<Full path to file>'

Creates the following services

'MpsSvcc' <Full path to file>

Malicious functions

Executes the following

'%WINDIR%\syswow64\at.exe' /delete /yes
'%WINDIR%\syswow64\taskkill.exe' /im ftp.exe /f
'%WINDIR%\syswow64\taskkill.exe' /im cscript.exe /f
'%WINDIR%\syswow64\taskkill.exe' /im 6.111 /f
'%WINDIR%\syswow64\taskkill.exe' /im wdl.111 /f

Searches for windows to

detect analytical utilities:

ClassName: 'FileMonClass', WindowName: ''
ClassName: 'RegMonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\temp\raidtest
%TEMP%\killminer.bat
%WINDIR%\ime\<File name>.exe
%WINDIR%\temp\killminer.bat
C:\users\public\videos\windowsup.bat
%WINDIR%\temp\updatepatch\kadb.exe

Sets the 'hidden' attribute to the following files

<Full path to file>
C:\users\public\videos\windowsup.bat
%WINDIR%\temp\updatepatch\kadb.exe

Deletes the following system files

<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723426318
<SYSTEM32>\tasks\microsoft\office\office 15 subscription heartbeat
<SYSTEM32>\tasks\microsoft\office\officetelemetryagentfallback2016
<SYSTEM32>\tasks\microsoft\office\officetelemetryagentlogon2016
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 64
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 64 critical
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.30319 critical
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\appid\edp policy manager
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\application experience\microsoft compatibility appraiser
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\application experience\startupapptask
<SYSTEM32>\tasks\microsoft\windows\applicationdata\appuriverifierdaily
<SYSTEM32>\tasks\microsoft\windows\applicationdata\appuriverifierinstall
<SYSTEM32>\tasks\microsoft\windows\applicationdata\cleanuptemporarystate
<SYSTEM32>\tasks\microsoft\windows\applicationdata\dssvccleanup
<SYSTEM32>\tasks\microsoft\windows\appxdeploymentclient\pre-staged app cleanup
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\bitlocker\bitlocker encrypt all drives
<SYSTEM32>\tasks\microsoft\windows\bitlocker\bitlocker mdm policy refresh
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\brokerinfrastructure\bgtaskregistrationmaintenancetask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\aikcertenrolltask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\cryptopolicytask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\keypregentask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\chkdsk\proactivescan
<SYSTEM32>\tasks\microsoft\windows\chkdsk\syspartrepair
<SYSTEM32>\tasks\microsoft\windows\clip\license validation
<SYSTEM32>\tasks\microsoft\windows\cloudexperiencehost\createobjecttask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity check and scan
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity scan
<SYSTEM32>\tasks\microsoft\windows\data integrity scan\data integrity scan for crash recovery
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\device setup\metadata refresh
<SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handlecommand
<SYSTEM32>\tasks\microsoft\windows\devicedirectoryclient\handlewnscommand
<SYSTEM32>\tasks\microsoft\windows\diagnosis\recommendedtroubleshootingscanner
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\directx\directxdatabaseupdater
<SYSTEM32>\tasks\microsoft\windows\directx\dxgiadaptercache
<SYSTEM32>\tasks\microsoft\windows\diskcleanup\silentcleanup
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\diskfootprint\diagnostics
<SYSTEM32>\tasks\microsoft\windows\diskfootprint\storagesense
<SYSTEM32>\tasks\microsoft\windows\edp\edp app launch task
<SYSTEM32>\tasks\microsoft\windows\edp\edp auth task
<SYSTEM32>\tasks\microsoft\windows\edp\edp inaccessible credentials task
<SYSTEM32>\tasks\microsoft\windows\edp\storagecardencryption task
<SYSTEM32>\tasks\microsoft\windows\exploitguard\exploitguard mdm policy refresh
<SYSTEM32>\tasks\microsoft\windows\feedback\siuf\dmclient
<SYSTEM32>\tasks\microsoft\windows\feedback\siuf\dmclientonscenariodownload
<SYSTEM32>\tasks\microsoft\windows\file classification infrastructure\property definition sync
<SYSTEM32>\tasks\microsoft\windows\filehistory\file history (maintenance mode)
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\reconcilefeatures
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\usagedataflushing
<SYSTEM32>\tasks\microsoft\windows\flighting\featureconfig\usagedatareporting
<SYSTEM32>\tasks\microsoft\windows\helloface\fodcleanuptask
<SYSTEM32>\tasks\microsoft\windows\input\localusersyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\mousesyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\pensyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\input\touchpadsyncdataavailable
<SYSTEM32>\tasks\microsoft\windows\installservice\scanforupdates
<SYSTEM32>\tasks\microsoft\windows\installservice\scanforupdatesasuser
<SYSTEM32>\tasks\microsoft\windows\installservice\smartretry
<SYSTEM32>\tasks\microsoft\windows\installservice\wakeupandcontinueupdates
<SYSTEM32>\tasks\microsoft\windows\installservice\wakeupandscanforupdates
<SYSTEM32>\tasks\microsoft\windows\international\synchronize language settings
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\installation
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\reconcilelanguageresources
<SYSTEM32>\tasks\microsoft\windows\languagecomponentsinstaller\uninstallation
<SYSTEM32>\tasks\microsoft\windows\license manager\tempsignedlicenseexchange
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\location\windowsactiondialog
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\cellular
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\logon
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\retry
<SYSTEM32>\tasks\microsoft\windows\management\provisioning\runonreboot
<SYSTEM32>\tasks\microsoft\windows\maps\mapstoasttask
<SYSTEM32>\tasks\microsoft\windows\maps\mapsupdatetask
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\processmemorydiagnosticevents
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\runfullmemorydiagnostic
<SYSTEM32>\tasks\microsoft\windows\mobile broadband accounts\mno metadata parser
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\nlasvc\wifitask
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\pi\secure-boot-update
<SYSTEM32>\tasks\microsoft\windows\pi\sqm-tasks
<SYSTEM32>\tasks\microsoft\windows\plug and play\device install group policy
<SYSTEM32>\tasks\microsoft\windows\plug and play\device install reboot required
<SYSTEM32>\tasks\microsoft\windows\plug and play\sysprep generalize drivers
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\printing\eduprintprov
<SYSTEM32>\tasks\microsoft\windows\pushtoinstall\logincheck
<SYSTEM32>\tasks\microsoft\windows\pushtoinstall\registration
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\recoveryenvironment\verifywinre
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\servicing\startcomponentcleanup
<SYSTEM32>\tasks\microsoft\windows\settingsync\backgrounduploadtask
<SYSTEM32>\tasks\microsoft\windows\settingsync\networkstatechangetask
<SYSTEM32>\tasks\microsoft\windows\setup\setupcleanuptask
<SYSTEM32>\tasks\microsoft\windows\sharedpc\account cleanup
<SYSTEM32>\tasks\microsoft\windows\shell\createobjecttask
<SYSTEM32>\tasks\microsoft\windows\shell\familysafetymonitor
<SYSTEM32>\tasks\microsoft\windows\shell\familysafetyrefreshtask
<SYSTEM32>\tasks\microsoft\windows\shell\indexerautomaticmaintenance
<SYSTEM32>\tasks\microsoft\windows\shell\updateuserpicturetask
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttasklogon
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttasknetwork
<SYSTEM32>\tasks\microsoft\windows\spaceport\spaceagenttask
<SYSTEM32>\tasks\microsoft\windows\spaceport\spacemanagertask
<SYSTEM32>\tasks\microsoft\windows\speech\speechmodeldownloadtask
<SYSTEM32>\tasks\microsoft\windows\staterepository\maintenancetasks
<SYSTEM32>\tasks\microsoft\windows\storage tiers management\storage tiers management initialization
<SYSTEM32>\tasks\microsoft\windows\storage tiers management\storage tiers optimization
<SYSTEM32>\tasks\microsoft\windows\subscription\enablelicenseacquisition
<SYSTEM32>\tasks\microsoft\windows\subscription\licenseacquisition
<SYSTEM32>\tasks\microsoft\windows\sysmain\hybriddrivecacheprepopulate
<SYSTEM32>\tasks\microsoft\windows\sysmain\hybriddrivecacherebalance
<SYSTEM32>\tasks\microsoft\windows\sysmain\respristaticdbsync
<SYSTEM32>\tasks\microsoft\windows\sysmain\wsswapassessmenttask
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\time synchronization\forcesynchronizetime
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\time zone\synchronizetimezone
<SYSTEM32>\tasks\microsoft\windows\tpm\tpm-hascertretr
<SYSTEM32>\tasks\microsoft\windows\tpm\tpm-maintenance
%WINDIR%\tasks\sa.dat
<SYSTEM32>\tasks\microsoft\windows\updateorchestrator\report policies
<SYSTEM32>\tasks\microsoft\windows\updateorchestrator\schedule scan
<SYSTEM32>\tasks\microsoft\windows\updateorchestrator\schedule scan static task
<SYSTEM32>\tasks\microsoft\windows\updateorchestrator\updatemodeltask
<SYSTEM32>\tasks\microsoft\windows\updateorchestrator\uso_uxbroker
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\tasks\microsoft\windows\usb\usb-notifications
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\wcm\wifitask
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender cache maintenance
<SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender cleanup
<SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender scheduled scan
<SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender verification
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows\windowsupdate\scheduled start
<SYSTEM32>\tasks\microsoft\windows\wininet\cachetask
<SYSTEM32>\tasks\microsoft\windows\wlansvc\cdssync
<SYSTEM32>\tasks\microsoft\windows\wof\wim-hash-management
<SYSTEM32>\tasks\microsoft\windows\wof\wim-hash-validation
<SYSTEM32>\tasks\microsoft\windows\work folders\work folders logon synchronization
<SYSTEM32>\tasks\microsoft\windows\work folders\work folders maintenance work
<SYSTEM32>\tasks\microsoft\windows\workplace join\automatic-device-join
<SYSTEM32>\tasks\microsoft\windows\workplace join\device-sync
<SYSTEM32>\tasks\microsoft\windows\workplace join\recovery-check
<SYSTEM32>\tasks\microsoft\windows\wwansvc\notificationtask
<SYSTEM32>\tasks\microsoft\windows\wwansvc\oobediscovery
<SYSTEM32>\tasks\mozilla\firefox default browser agent 308046b0af4a39cb

Deletes following files that it created itself

%TEMP%\killminer.bat
%WINDIR%\temp\killminer.bat
<SYSTEM32>\tasks\tomcat

Substitutes the following files

%TEMP%\killminer.bat
%WINDIR%\temp\killminer.bat

Network activity

TCP

Other

'15#.#01.193.91':443

UDP

DNS ASK xm#.#rbpool.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'schtasks.exe'
ClassName: '' WindowName: ''

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\KillMiner.bat
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\IME\Microsoft /T /D users
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\IME\Microsoft /T /D administrators
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\IME\Microsoft /T /D SYSTEM
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\IME\Crypt /T /D users
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\IME\Crypt /T /D administrators
'%WINDIR%\syswow64\cacls.exe' %WINDIR%\IME\Crypt /T /D SYSTEM
'%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Delete /TN * /F
'%WINDIR%\syswow64\schtasks.exe' /Delete /TN * /F
'%WINDIR%\syswow64\cmd.exe' /c at /delete /yes
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn tomcat /tr %WINDIR%\IME\<File name>.exe /sc daily /st 23:59
'%WINDIR%\syswow64\schtasks.exe' /create /tn tomcat /tr %WINDIR%\IME\<File name>.exe /sc daily /st 23:59
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\TEMP\\KillMiner.bat
'%WINDIR%\temp\updatepatch\kadb.exe'
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\KillMiner.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Delete /TN * /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c at /delete /yes' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn tomcat /tr %WINDIR%\IME\<File name>.exe /sc daily /st 23:59' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\TEMP\\KillMiner.bat' (with hidden window)
'%WINDIR%\temp\updatepatch\kadb.exe' ' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /im ftp.exe /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /im cscript.exe /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /im 6.111 /f' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /im wdl.111 /f' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial