Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\!!readme!!!.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\net.exe' stop MSSQLSERVER /f /m
Modifies file system
Creates the following files
- C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\desktop-connector-files-select\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\desktop-connector-files\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account-select\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win8-scrollbar\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\!!readme!!!.txt
- %ProgramFiles%\winrar\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\visualelements\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-sharepoint-files-select\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer-select\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\css\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\uninstall\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\isp\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\fonts\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\!!readme!!!.txt
- D:\!!readme!!!.txt
- C:\kms\!!readme!!!.txt
- D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\!!readme!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\defaults\messenger\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\chrome\icons\default\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\uninstall\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\fonts\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\distibution\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\browser\visualelements\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\browser\features\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\!!readme!!!.txt
- %ProgramFiles%\mozilla firefox\browser\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\security\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\management\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\jfr\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\fonts\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\ext\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\deploy\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\cmm\!!readme!!!.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\!!readme!!!.txt
- %ProgramFiles%\mozilla thunderbird\features\!!readme!!!.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\!!readme!!!.txt
Modifies the following files
- C:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\proof.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\powerpointmui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\outlookmui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\onenotemui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\office32ww.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\office32mui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\officemuiset.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\officemui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\infopathmui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\groovemui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\excelmui.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\setup.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\accessmuiset.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\accessmui.xml
- <Drive name for removable media>:\default.bmp
- D:\install.log
- C:\kms\kms_vl_all_aio_debug.log
- D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\desktop.ini
- <Drive name for removable media>:\delete.avi
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\proof.xml
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\proof.xml
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f' (with hidden window)
- '<SYSTEM32>\net.exe' stop MSSQLSERVER /f /m' (with hidden window)
Executes the following
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f
- '<SYSTEM32>\net1.exe' stop MSSQLSERVER /f /m
