Trojan.MSIL.RAWLD.THBOFBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Windows%\Help\Stage3.exe
• {Malware Path}\log\Stage2{yyyy-MM-dd}.bin

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Agrega los procesos siguientes:

• If the machine is not in Safe Mode and neither "%Windows%\Help\Finish.exe" nor "%Windows%\Help\Exclude.exe" exists:
  • "cmd" /c start %Windows%\Help\Stage3.exe
• If the machine is in SafeMode but either "%Windows%\Help\Finish.exe" or "%Windows%\Help\Exclude.exe" exists:
  • "cmd" /c del %Windows%\Help\Stage3.exe
  • "cmd" /c del %Windows%\Help\Pay.txt
  • "sc" delete MSOfficeRunOncelsls
  • "reg" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSOfficeRunOncelsls" /f
  • "cmd" /c start ping 127.0.0.1 -n 10 && cmd /c del %Windows%\Help\Stage2.exe && cmd /c shutdown -r -f -t 00
  • "shutdown" -r -f -t 00
• If the machine is not in Safe Mode and neither "%Windows%\Help\Finish.exe" nor "%Windows%\Help\Exclude.exe" exists:
  • "sc" create MSOfficeRunOncelsls binpath= %Windows%\Help\Stage2.exe start= auto displayname= MSOfficeRunOncelsls
  • "reg" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSOfficeRunOncelsls" /t REG_SZ /d Service /f
  • "shutdown" -r -f -t 00

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Crea las carpetas siguientes:

• {Malware Path}\log

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
MSOfficeRunOncelsls
(default) = Service

Agrega las siguientes claves de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
MSOfficeRunOncelsls

Elimina las siguientes claves de registro:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
MSOfficeRunOncelsls

Otros detalles

Hace lo siguiente:

• It configures the Boot Configuration Data (BCD) to:
  • enable safe boot option with networking
  • disable safe boot option
• It checks for the following files to determine prior compromise or the exclusion of the machine from infection:
  • %Windows%\Help\Finish.exe
  • %Windows%\Help\Exclude.exe
• It creates a log file if any error is encountered during execution.
• It performs different actions depending on the result of system and file checks:
  • If executed in Safe Mode and passed the file verification:
    • It decrypts the contents of the file %Windows%\Help\Pay.txt using a hard-coded decryption key.
    • The decrypted content is saved as %Windows%\Help\Stage3.exe and executed.
  • If executed in Safe Mode but did not pass the file verification:
    • It disables the Safe Boot option, deletes malware remnants, and reboots the machine.
  • If not executed in Safe Mode and passed the file verification:
    • It enables the Safe Boot with Networking, creates a service, adds a registry key, and reboots the machine.
• It adds the following service:
  • Name: MSOfficeRunOncelsls
  • Start Type: Autostart
  • Binary Path: %Windows%\Help\Stage2.exe
• It deletes the following service:
  • MSOfficeRunOncelsls

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).