Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*CryptoLocker' = '<LS_APPDATA>\Oonofhfghahtjdtr.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '<LS_APPDATA>\Oonofhfghahtjdtr.exe'
Malicious functions:
Creates and executes the following:
- '<LS_APPDATA>\Oonofhfghahtjdtr.exe' -w108
- '<LS_APPDATA>\Oonofhfghahtjdtr.exe' "-r<Full path to virus>"
Executes the following:
- '<SYSTEM32>\wermgr.exe' "-outproc" "836" "4124"
- '<SYSTEM32>\wermgr.exe' -queuereporting
Modifies file system :
Creates the following files:
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80072f78_805ff6e6daf5fedbb13daf2b1d56b5cbd7ea195_cab_0dcca0e0\client_manifest.txt
- %WINDIR%\Temp\OutofProcReport1090937.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.6.7600.256_d2caf64b7dbca2d781154d2562964c262846251_cab_0df4a784\Report.wer
- <LS_APPDATA>\Oonofhfghahtjdtr.exe
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\home[1].htm
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\Oonofhfghahtjdtr.exe
Deletes the following files:
- %WINDIR%\Temp\OutofProcReport1090937.txt
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\home[1].htm
Deletes itself.
Network activity:
Connects to:
- 'nk####ogaspb.net':80
- 'pp####gatlva.biz':80
- 'mu####ibglen.com':80
- 'km####udadvm.co.uk':80
- 'lc####bitkha.info':80
- 'th####vulujw.info':80
- 'hj####jcyfvk.com':80
- 'ew####ofiwyk.co.uk':80
- 'dr###uthhvin.ru':80
- 'qu####bxummw.org':80
- 'px####iamgot.co.uk':80
- 'ec####rkysxd.info':80
- 'ct####emskpc.org':80
- 'ce####qpfuwx.biz':80
- 'pi###fudyqvp.ru':80
- 'kw###ohgmndi.ru':80
- 'lm####nlguov.org':80
- 'je####anamgu.biz':80
- 'rg####vxsowu.com':80
- 'io####tigfuh.net':80
- '20#.#6.232.182':80
- 'xm####bbkfwa.info':80
- 'jg####kepste.co.uk':80
- 've####gqloli.org':80
- 'download.windowsupdate.com':80
- 'ce###bqvcokw.ru':80
- 'pg####ujgsss.org':80
- 'nx####ayhchb.biz':80
- 'lo####foojfv.com':80
- 'av####vldxyf.net':80
- 'ui####qdgbtj.org':80
- 'ua####vytetk.co.uk':80
- 'tu###bbbsddn.ru':80
- 'um####qsmvat.net':80
- 'io####eaagmh.biz':80
- 'yr####ltlnhh.biz':80
- 'af###nbvylxd.ru':80
- 'ya####gxxkhg.net':80
- 'vn####lbhckg.info':80
- 'xm####qvkmqk.com':80
- 'na####hfsino.net':80
- 'bh####eymjjp.biz':80
- 'ol###mimgfih.ru':80
- 'md####nchowp.net':80
- 'kt####fsiufj.info':80
- 'yy####jonsxx.com':80
- 'gx####xbpyxp.com':80
- 'hr####afulei.net':80
- 'fi####rvvrmc.info':80
- 'da####wlwbbk.org':80
- 'ep####dqqimx.co.uk':80
- 'bd####aajbmt.info':80
- 'cs####pcadgl.com':80
- 'yg####hgdttk.co.uk':80
- 'gt####vkdxricgl.biz':80
- 'xq####remras.org':80
- 'il####kijetr.org':80
- 'wp####bfoygr.co.uk':80
- 'uh###qgupiua.ru':80
- 'ci####uxkcdq.net':80
- 'dx####kabewi.biz':80
- 'df####hrdltn.net':80
- 'eu####wttnnf.biz':80
- 'dp####jclytr.com':80
- 'ko####frghna.co.uk':80
- 'ca####tauwaa.info':80
- 'gs####xonlok.info':80
- 'av####drymow.com':80
- 'fd####imwjus.co.uk':80
- 'ex###vuuoubf.ru':80
- 'fn####kwfwuw.org':80
- 'th####dxnect.co.uk':80
- 'hl####qfeush.info':80
- 'kp####bunjbn.org':80
- 'ih####gkospv.biz':80
- 'ja###vuptcpa.ru':80
- 'jj###praxstm.ru':80
- 'wk####rkpqwm.org':80
- 'vf####eshcdy.biz':80
- 'um####qpvsvh.com':80
- 'iq####ewmjmu.net':80
UDP:
- DNS ASK nk####ogaspb.net
- DNS ASK pp####gatlva.biz
- DNS ASK mu####ibglen.com
- DNS ASK km####udadvm.co.uk
- DNS ASK lc####bitkha.info
- DNS ASK th####vulujw.info
- DNS ASK hj####jcyfvk.com
- DNS ASK ew####ofiwyk.co.uk
- DNS ASK dr###uthhvin.ru
- DNS ASK qu####bxummw.org
- DNS ASK px####iamgot.co.uk
- DNS ASK ec####rkysxd.info
- DNS ASK ct####emskpc.org
- DNS ASK ce####qpfuwx.biz
- DNS ASK pi###fudyqvp.ru
- DNS ASK kw###ohgmndi.ru
- DNS ASK lm####nlguov.org
- DNS ASK je####anamgu.biz
- DNS ASK rg####vxsowu.com
- DNS ASK io####tigfuh.net
- DNS ASK um####qsmvat.net
- DNS ASK xm####bbkfwa.info
- DNS ASK lo####foojfv.com
- DNS ASK do#####d.microsoft.com
- DNS ASK download.windowsupdate.com
- DNS ASK jg####kepste.co.uk
- DNS ASK ce###bqvcokw.ru
- DNS ASK pg####ujgsss.org
- DNS ASK nx####ayhchb.biz
- DNS ASK www.up####.microsoft.com
- DNS ASK av####vldxyf.net
- DNS ASK ua####vytetk.co.uk
- DNS ASK vn####lbhckg.info
- DNS ASK ui####qdgbtj.org
- DNS ASK io####eaagmh.biz
- DNS ASK tu###bbbsddn.ru
- DNS ASK af###nbvylxd.ru
- DNS ASK ve####gqloli.org
- DNS ASK yr####ltlnhh.biz
- DNS ASK xm####qvkmqk.com
- DNS ASK ya####gxxkhg.net
- DNS ASK bh####eymjjp.biz
- DNS ASK ol###mimgfih.ru
- DNS ASK md####nchowp.net
- DNS ASK kt####fsiufj.info
- DNS ASK yy####jonsxx.com
- DNS ASK gx####xbpyxp.com
- DNS ASK hr####afulei.net
- DNS ASK fi####rvvrmc.info
- DNS ASK da####wlwbbk.org
- DNS ASK ep####dqqimx.co.uk
- DNS ASK bd####aajbmt.info
- DNS ASK cs####pcadgl.com
- DNS ASK yg####hgdttk.co.uk
- DNS ASK gt####vkdxricgl.biz
- DNS ASK xq####remras.org
- DNS ASK il####kijetr.org
- DNS ASK wp####bfoygr.co.uk
- DNS ASK uh###qgupiua.ru
- DNS ASK ci####uxkcdq.net
- DNS ASK dx####kabewi.biz
- DNS ASK ih####gkospv.biz
- DNS ASK eu####wttnnf.biz
- DNS ASK ex###vuuoubf.ru
- DNS ASK df####hrdltn.net
- DNS ASK ca####tauwaa.info
- DNS ASK dp####jclytr.com
- DNS ASK av####drymow.com
- DNS ASK na####hfsino.net
- DNS ASK gs####xonlok.info
- DNS ASK fn####kwfwuw.org
- DNS ASK fd####imwjus.co.uk
- DNS ASK hl####qfeush.info
- DNS ASK um####qpvsvh.com
- DNS ASK th####dxnect.co.uk
- DNS ASK ja###vuptcpa.ru
- DNS ASK kp####bunjbn.org
- DNS ASK wk####rkpqwm.org
- DNS ASK ko####frghna.co.uk
- DNS ASK jj###praxstm.ru
- DNS ASK iq####ewmjmu.net
- DNS ASK vf####eshcdy.biz
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
