TROJ_CRYPWALL.XXRL

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• {folders in drives}:\HELP_DECRYPT.HTML
• {folders in drives}:\HELP_DECRYPT.PNG
• {folders in drives}:\HELP_DECRYPT.TXT
• {folders in drives}:\HELP_DECRYPT.URL

It drops the following copies of itself into the affected system:

• %System Root%\5fa97489\5fa97489.exe
• %Application Data%\5fa97489.exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %System Root%\5fa97489

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
5fa9748 = "%System Root%\5fa97489\5fa97489.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
5fa97489 = "%Application Data%\5fa97489.exe"

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\5fa97489.exe - copy of itself

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\18A721155C52E2V5C89835C74E2BFA25

HKEY_CURRENT_USER\Software\18A721155C52E2V5C89835C74E2BFA25\
2234557889ABCCEF

HKEY_CURRENT_USER\Software\PJ Naughter

HKEY_CURRENT_USER\Software\PJ Naughter\
{malware file name}

HKEY_CURRENT_USER\Software\PJ Naughter\
{malware file name}\Recent File List

HKEY_CURRENT_USER\Software\PJ Naughter\
{malware file name}\Settings

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = "3"

(Note: The default value data of the said registry entry is 2.)

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}namann.com/wp-content/themes/the-bootstrap/g1.php
• {BLOCKED}skun.com/wp-content/themes/lotus/g1.php
• {BLOCKED}.be/wp-content/themes/inovado/g2.php
• {BLOCKED}.com.br/wp-content/themes/pinpoint/g1.php
• {BLOCKED}.com/wp-content/themes/bretheon/g2.php
• {BLOCKED}ddicted.com/SimplePhpTest001.php
• {BLOCKED}o.uk.com/wp-content/themes/whisper/g3.php
• {BLOCKED}ira.com.br/wp-content/themes/Avada/g2.php
• {BLOCKED}nebevihayatyayinlari.com/wp-content/themes/Avada/g1.php
• {BLOCKED}itects.net/wp-content/themes/dkarchitects/g4.php
• {BLOCKED}ocassis.com.br/wp-content/themes/winestore/g4.php
• {BLOCKED}tudio.com/wp-content/themes/contrast/g2.php
• {BLOCKED}estegemann.com/wp-content/themes/bostan/g3.php
• {BLOCKED}ansonax.com/wp-content/themes/kallyas/g1.php
• {BLOCKED}rt.com/ueditor/dialogs/attachment/fileTypeImages/g2.php
• {BLOCKED}parent.com/wp-content/themes/quasartheme/g3.php
• {BLOCKED}alartesano.com/wp-content/themes/Avada/g5.php
• {BLOCKED}brugge.com/wp-content/themes/Avada/g3.php
• {BLOCKED}werkend.be/wp-content/themes/ventus/g5.php
• {BLOCKED}cia.es/wp-content/themes/CasualHotel/g3.php
• {BLOCKED}ch.at/wp-content/themes/Avada/g4.php
• {BLOCKED}.com.br/wp-content/uploads/revslider/drive_slider1/g3.php
• {BLOCKED}ll.jimmyandpana.com/wp-content/plugins/w3-total-cache/lib/Microsoft/WindowsAzure/Storage/Blob/g4.php
• {BLOCKED}endislik.com/wp-content/themes/rttheme17/g5.php
• {BLOCKED}avt.com/wp-content/themes/nerey2/g1.php
• {BLOCKED}x.com/wp-content/themes/attitude-pro/g5.php
• {BLOCKED}korasyon.com.tr/wp-content/themes/webdesignV-5/g5.php
• {BLOCKED}newbuild.co.uk/wp-content/themes/Avada-Child-Theme/g5.php
• {BLOCKED}.stam.is/cache/Smarty/compile/g1.php
• {BLOCKED}ilbr.com.br/wp-content/themes/tecnosilbr/g4.php
• {BLOCKED}unyasi.com/wp-content/themes/decoy/g2.php
• {BLOCKED}clelounge.com/wp-content/themes/striking_r/g1.php
• {BLOCKED}ating.sk/wp-content/themes/tsk-theme/g3.php
• {BLOCKED}nyapi.com/wp-content/themes/pindol/g5.php
• {BLOCKED}erclub.ru/wp-content/themes/ingrid/g4.php

It deletes itself after execution.

NOTES:

This Trojan is capable of encrypting files.