Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- C:\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\whathappened.txt
- C:\kms\whathappened.txt
- <Current directory>\whathappened.txt
- C:\perflogs\whathappened.txt
- C:\perflogs\admin\whathappened.txt
- %ALLUSERSPROFILE%\whathappened.txt
- %ALLUSERSPROFILE%\adobe\whathappened.txt
- %ALLUSERSPROFILE%\adobe\arm\whathappened.txt
- %ALLUSERSPROFILE%\adobe\arm\s\whathappened.txt
- %ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\whathappened.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\whathappened.txt
- %ALLUSERSPROFILE%\adobe\setup\whathappened.txt
- %ALLUSERSPROFILE%\microsoft help\whathappened.txt
- %ALLUSERSPROFILE%\oracle\whathappened.txt
- %ALLUSERSPROFILE%\oracle\java\whathappened.txt
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\whathappened.txt
- %ALLUSERSPROFILE%\oracle\java\javapath\whathappened.txt
- %ALLUSERSPROFILE%\package cache\whathappened.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\whathappened.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\whathappened.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\whathappened.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\whathappened.txt
- %ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\whathappened.txt
Modifies the following files
- C:\kms\kms_vl_all_aio_debug.log.spkqc
- %ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.spkqc
- %ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.spkqc
- %ALLUSERSPROFILE%\microsoft help\nslist.hxl.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.setlang.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.powerpnt.dev.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.outlook.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.onenote.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.powerpnt.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.ois.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.outlook.dev.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.mstore.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.mspub.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.msouc.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.mspub.dev.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.msaccess.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.msaccess.dev.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.groove.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.infopatheditor.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.infopath.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\ms.graph.14.1033.hxn.spkqc
- %ALLUSERSPROFILE%\microsoft help\hx.hxn.spkqc
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.spkqc
- %ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.spkqc
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.spkqc
Modifies multiple files.
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } recoveryenabled No' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
- '<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } recoveryenabled No
- '<SYSTEM32>\cmd.exe' /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\bcdedit.exe' / set{ default } bootstatuspolicy ignoreallfailures
