Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<SYSTEM32>\recovery.exe'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\recovery.exe
Moves the following files
- from %ProgramFiles%\internet explorer\signup\install.ins to %ProgramFiles%\internet explorer\signup\install.ins.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\cursors.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties to %ProgramFiles%\java\jre1.8.0_45\lib\hijrah-config-umalqura.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterregular.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidatypewriterbold.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansregular.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidasansdemibold.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightregular.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightitalic.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemiitalic.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf to %ProgramFiles%\java\jre1.8.0_45\lib\fonts\lucidabrightdemibold.ttf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.properties.src.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc to %ProgramFiles%\java\jre1.8.0_45\lib\fontconfig.bfc.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties to %ProgramFiles%\java\jre1.8.0_45\lib\flavormap.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties to %ProgramFiles%\java\jre1.8.0_45\lib\javafx.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja to %ProgramFiles%\java\jre1.8.0_45\lib\psfont.properties.ja.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar to %ProgramFiles%\java\jre1.8.0_45\lib\plugin.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\net.properties to %ProgramFiles%\java\jre1.8.0_45\lib\net.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar to %ProgramFiles%\java\jre1.8.0_45\lib\management-agent.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\snmp.acl.template.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties to %ProgramFiles%\java\jre1.8.0_45\lib\management\management.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.password.template.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties to %ProgramFiles%\java\jre1.8.0_45\lib\logging.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access to %ProgramFiles%\java\jre1.8.0_45\lib\management\jmxremote.access.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt to %ProgramFiles%\java\jre1.8.0_45\lib\jvm.hprof.txt.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jsse.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfxswt.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jfr.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\profile.jfc.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc to %ProgramFiles%\java\jre1.8.0_45\lib\jfr\default.jfc.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar to %ProgramFiles%\java\jre1.8.0_45\lib\jce.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar to %ProgramFiles%\java\jre1.8.0_45\lib\javaws.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties to %ProgramFiles%\java\jre1.8.0_45\lib\psfontj2d.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\zipfs.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunpkcs11.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunmscapi.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_de.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\currency.data to %ProgramFiles%\java\jre1.8.0_45\lib\currency.data.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties to %ProgramFiles%\java\jre1.8.0_45\lib\content-types.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\srgb.pf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\pycc.pf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\linear_rgb.pf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\gray.pf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf to %ProgramFiles%\java\jre1.8.0_45\lib\cmm\ciexyz.pf.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar to %ProgramFiles%\java\jre1.8.0_45\lib\charsets.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg to %ProgramFiles%\java\jre1.8.0_45\lib\amd64\jvm.cfg.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.rwg
- from %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt to %ProgramFiles%\java\jre1.8.0_45\bin\server\xusage.txt.rwg
- from %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl to %ProgramFiles%\java\jre1.8.0_45\bin\javacpl.cpl.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_es.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_fr.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_it.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ja.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunec.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\nashorn.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\localedata.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jaccess.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\dnsns.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\cldrdata.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar to %ProgramFiles%\java\jre1.8.0_45\lib\deploy.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\access-bridge-64.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_tw.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_hk.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_zh_cn.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_sv.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_pt_br.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\messages_ko.properties.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\sunjce_provider.jar.rwg
- from %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar to %ProgramFiles%\java\jre1.8.0_45\lib\resources.jar.rwg
Modifies the following files
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\notepad.exe' <SYSTEM32>\RansomWar.txt
