Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
Modifies file system
Creates the following files
- %TEMP%\tmpf225.tmp
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\infoicon.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf3.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_busy.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\icebucket.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\stackedicecubes.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf2.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\resignin.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_appinvite.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf1.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\globeicon.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\erroricon.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\recyclebin.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf0.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\done_graphic.svg.sos
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\user.js.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dialtone.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_activepresenterchange.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\premiumicon.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_abbrdialtone.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\paused.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_connecting.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_pictures.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chevronup.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_changemodality.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_documents.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\partiallyfreezing.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_callended.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\folder_image_desktop.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\chevron.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\foldericon.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cloud.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\finderextensionprompt.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\shield_icon.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\foldericon.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_videoadded.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\acmdismissicon.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_iminvite.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\loading_spinner.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_videocall.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf7.wav.sos
- %ProgramFiles(x86)%\opera\36.0.2130.46\resources\license.txt.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\04 - disk management.lnk.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf8.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_documents.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_joinedconference.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\cancelicon.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf9.wav.sos
- %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\warning-symbol_grey.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf4.wav.sos
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_howler.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf6.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\loading.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\waterglass.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\finderextensionprompt.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_untag.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_fsringing.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_ringtone6.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_dtmf5.wav.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_secondcall.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\kfm_folders_image.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_fastbusy.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\signin.svg.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_ringtone7.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_selected.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_in_progress.svg.sos
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask03_11_14_25_08_7362.txt.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group2\3 - windows explorer.lnk.sos
- %APPDATA%\microsoft\windows\sendto\fax recipient.lnk.sos
- %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group2\2 - search.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group2\1 - run.lnk.sos
- %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group1\1 - desktop.lnk.sos
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.sos
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\sitesecurityservicestate.txt.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\thirdpartynotices.txt.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\collectsynclogs.bat.sos
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_192019924-msi_vc_red.msi.txt.sos
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group2\5 - task manager.lnk.sos
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_191926081-msi_vc_red.msi.txt.sos
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_192036284-msi_vc_red.msi.txt.sos
- %TEMP%\dd_vcredistmsi6d07.txt.sos
- %TEMP%\dd_ndp462-kb3151800-x86-x64-allos-enu_decompression_log.txt.sos
- %HOMEPATH%\links\downloads.lnk.sos
- %HOMEPATH%\desktop\telegram.lnk.sos
- %HOMEPATH%\links\desktop.lnk.sos
- %HOMEPATH%\desktop\microsoft edge.lnk.sos
- %HOMEPATH%\desktop\google chrome.lnk.sos
- %HOMEPATH%\desktop\february_catalogue__2015.doc.sos
- %ProgramFiles(x86)%\microsoft office\office16\logoimages\outlooklogo.contrast-black_scale-100.png.sos
- %HOMEPATH%\desktop\archer.avi.sos
- %HOMEPATH%\desktop\cveuropeo.doc.sos
- %ProgramFiles(x86)%\microsoft office\office16\logoimages\onenotelogosmall.scale-80.png.sos
- %HOMEPATH%\desktop\508softwareandos.doc.sos
- %TEMP%\dd_vcredistui6d07.txt.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\01 - command prompt.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group2\4 - control panel.lnk.sos
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\alternateservices.txt.sos
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_pictures.svg.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_hovered.svg.sos
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask03_11_14_13_41_1320.txt.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkmark_finished.svg.sos
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js.sos
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\checkboxcomposite.svg.sos
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask03_11_13_55_48_2104.txt.sos
- %APPDATA%\mozilla\firefox\profiles\jkail15y.default\user.js.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\cancelicon.svg.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\10 - appsandfeatures.lnk.sos
- %APPDATA%\microsoft\windows\start menu\programs\onedrive.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\09 - mobility center.lnk.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\darktheme\acmdismissicon.svg.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\08 - powerandsleep.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\07 - event viewer.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\01a - windows powershell.lnk.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_documents.svg.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\06 - systemabout.lnk.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005\images\darktheme\folder_image_desktop.svg.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\05 - device manager.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\04-1 - networkstatus.lnk.sos
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.postinstallationtask09_28_19_27_14_9743.txt.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_desktop.svg.sos
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask09_28_19_47_28_2155.txt.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\03 - computer management.lnk.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\02a - windows powershell.lnk.sos
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\securitypreloadstate.txt.sos
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\prefs.js.sos
- %LOCALAPPDATA%\microsoft\windows\winx\group3\02 - command prompt.lnk.sos
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt.sos
- %ProgramFiles(x86)%\microsoft office\office16\media\lync_muting.wav.sos
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\images\lighttheme\folder_image_pictures.svg.sos
Modifies the following files
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
TCP
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
