Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Changes the following executable system files
- <DRIVERS>\wdboot.sys.bak
- <DRIVERS>\wdfilter.sys.bak
- <DRIVERS>\wdnisdrv.sys.bak
Creates the following files on removable media
- <Drive name for removable media>:\xex_readme.txt
Modifies master boot record (MBR).
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Defender
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM avp.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avpui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM bdagent.exe
- '<SYSTEM32>\taskkill.exe' /F /IM vsserv.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avguard.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avgui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avastui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM mbam.exe
- '<SYSTEM32>\taskkill.exe' /F /IM msmpeng.exe
- '<SYSTEM32>\taskkill.exe' /F /IM nortonsecurity.exe
- '<SYSTEM32>\taskkill.exe' /F /IM symcorpui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM mcshield.exe
- '<SYSTEM32>\taskkill.exe' /F /IM mfeann.exe
- '<SYSTEM32>\taskkill.exe' /F /IM engineserver.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ekrn.exe
- '<SYSTEM32>\taskkill.exe' /F /IM egui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ccsvchst.exe
- '<SYSTEM32>\netsh.exe' firewall set opmode disable
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\tree_view.html
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- nul
- %WINDIR%\temp\1bea7f5b-ecda-4050-9803-91a071a66ffe
- %WINDIR%\temp\ae08f882-d3e3-45b3-81f8-aa8ac6176f00
- %WINDIR%\temp\45f89169-51e4-4c12-bdfe-c741ba2b7a93
- %WINDIR%\temp\457587e8-3c28-46db-b8c8-c7a728050b4b
- %WINDIR%\temp\941f9015-20ec-41ec-97ba-918e8bffcd1d
- <SYSTEM32>\spool\drivers\x64\3\new\tty.gpd
- <SYSTEM32>\spool\drivers\x64\pcc\prnge001.inf_amd64_1daeee8f3aa30fcb.cab
- <SYSTEM32>\spool\drivers\x64\3\new\ttyres.dll
- <SYSTEM32>\spool\drivers\x64\3\new\tty.ini
- <SYSTEM32>\spool\drivers\x64\3\new\tty.dll
- <SYSTEM32>\spool\drivers\x64\3\new\ttyui.dll
- <SYSTEM32>\spool\drivers\x64\3\new\ttyui.hlp
- C:\xex_readme.txt
- D:\xex_readme.txt
- %TEMP%\wallpaper.jpg
- <SYSTEM32>\spool\drivers\x64\3\tty.ini
Deletes following files that it created itself
- %WINDIR%\temp\ae08f882-d3e3-45b3-81f8-aa8ac6176f00
- %WINDIR%\temp\1bea7f5b-ecda-4050-9803-91a071a66ffe
- %WINDIR%\temp\45f89169-51e4-4c12-bdfe-c741ba2b7a93
- %WINDIR%\temp\941f9015-20ec-41ec-97ba-918e8bffcd1d
- %WINDIR%\temp\457587e8-3c28-46db-b8c8-c7a728050b4b
Moves the following files
- from <SYSTEM32>\spool\drivers\x64\3\new\tty.gpd to <SYSTEM32>\spool\drivers\x64\3\tty.gpd
- from <SYSTEM32>\spool\drivers\x64\3\new\ttyres.dll to <SYSTEM32>\spool\drivers\x64\3\ttyres.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\tty.ini to <SYSTEM32>\spool\drivers\x64\3\tty.ini
- from <SYSTEM32>\spool\drivers\x64\3\new\tty.dll to <SYSTEM32>\spool\drivers\x64\3\tty.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\ttyui.dll to <SYSTEM32>\spool\drivers\x64\3\ttyui.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\ttyui.hlp to <SYSTEM32>\spool\drivers\x64\3\ttyui.hlp
Modifies the following files
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini
- C:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml
- <Drive name for removable media>:\000814251_video_01.avi
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml
- <Drive name for removable media>:\1189.jpg
- C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml
- <Drive name for removable media>:\13.jpeg
- <Drive name for removable media>:\13.jpg
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml
- <Drive name for removable media>:\168.jpg
- C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml
- %ProgramFiles%\java\jre1.8.0_77\readme.txt
- %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt
- %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt
- %ProgramFiles%\java\jre1.8.0_77\bin\server\xusage.txt
- %ProgramFiles%\java\jre1.8.0_77\lib\amd64\jvm.cfg
- %ProgramFiles%\java\jre1.8.0_77\lib\jvm.hprof.txt
- %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file a.txt
- %ProgramFiles%\microsoft office\office16\1033\mso example intl setup file b.txt
- %ProgramFiles%\microsoft office\office16\mso example setup file a.txt
- %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote-manifest.ini
- %ProgramFiles%\microsoft office\office16\onenote\sendtoonenote.ini
- %ProgramFiles%\mozilla firefox\application.ini
- %ProgramFiles%\mozilla firefox\browser\crashreporter-override.ini
- %ProgramFiles%\mozilla firefox\browser\override.ini
- %ProgramFiles%\mozilla firefox\crashreporter.ini
- %ProgramFiles%\mozilla firefox\defaultagent.ini
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Network activity
Connects to
- 'ap#.#pify.org':443
- 'di##ord.com':443
- 'th.bing.com':443
TCP
Other
- 'ap#.#pify.org':443
- 'di##ord.com':443
- 'th.bing.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
- DNS ASK th.bing.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\sc.exe' stop Sense
- '<SYSTEM32>\sc.exe' config Sense start= disabled
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\rundll32.exe' printui.dll,PrintUIEntry /ia /m "Generic / Text Only"
- '<SYSTEM32>\bcdedit.exe' /set {bootmgr} path \EFI\Custom\malicious.efi
- '<SYSTEM32>\cmd.exe' /c net use * /delete /y
- '<SYSTEM32>\net.exe' use * /delete /y
- '<SYSTEM32>\sc.exe' config LanmanServer start= auto
- '<SYSTEM32>\sc.exe' start LanmanServer
- '<SYSTEM32>\notepad.exe' C:\XEX_README.txt
- '<SYSTEM32>\notepad.exe' D:\XEX_README.txt
- '<SYSTEM32>\notepad.exe' <Drive name for removable media>:\XEX_README.txt
- '<SYSTEM32>\sc.exe' stop WinDefend' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop Sense' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM avp.exe' (with hidden window)
- '<SYSTEM32>\sc.exe' config Sense start= disabled' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' delete shadows /for=C: /all /quiet' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' delete shadows /for=D: /all /quiet' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled no' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM avpui.exe' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' delete shadows /for=E: /all /quiet' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM bdagent.exe' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM vsserv.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM avguard.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM avgui.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM avastui.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM mbam.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM msmpeng.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM nortonsecurity.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM symcorpui.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM mcshield.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM mfeann.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM engineserver.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ekrn.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM egui.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ccsvchst.exe' (with hidden window)
- '<SYSTEM32>\rundll32.exe' printui.dll,PrintUIEntry /ia /m "Generic / Text Only"' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {bootmgr} path \EFI\Custom\malicious.efi' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net use * /delete /y' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {current} recoveryenabled no' (with hidden window)
- '<SYSTEM32>\sc.exe' config LanmanServer start= auto' (with hidden window)
- '<SYSTEM32>\sc.exe' start LanmanServer' (with hidden window)
- '<SYSTEM32>\netsh.exe' firewall set opmode disable' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off' (with hidden window)
