Trojan.PS1.UTCLOCKER.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• cmd.exe /c cd /d "%Public%\Libraries\Identities" & set "VS100WOW64MODE=True" & reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedScripts" /se " " /v "TEXT_01" | powershell "-" 2>nul
  • this process will create an environment variable "VS100WOW64MODE" with value "True" and execute the script found in the registry entry via powershell
• iexplore.exe http://10.{BLOCKED}.{BLOCKED}.247/count01

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Defender Deamon = "%System%\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedScripts" /se " " /v "TEXT_01" | powershell "-" 2>nul"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\SecurityFolders\v2.0.3071

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
.NETFramework\SecurityFolders\v3.0.5109

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoAdminLogon = 1

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
AutoLogonSID = ""

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultDomainName = ""

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultUserName = "Login account disabled due to system failure!Only members of {VICTIM ID} are allowed to email {VICTIM ID}@protonmail.com for assisstance.Identify yourselfwhile contact!"

(Note: The default value data of the said registry entry is {User Preference}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
DefaultPassword = ""

(Note: The default value data of the said registry entry is {User Preference}.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SECURITY\Cache

Other Details

This Trojan does the following:

• It takes ownership of the directory and files found in %Public%\Libraries\Identities
• It sets access control list permissions on the following directory/registries:
  • %Public%\Libraries\Identities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\SecurityFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedScripts
• It disables the following:
  • all physical network adapters
  • user account whose name is not "anonymous443"
• After executing most of its routines, it shutdowns the affected system if the system's computer name is not the same with the domain owner or the user is not "anonymous443"
• It is capable of enabling physical network adapters and user accounts if it satisfies the following conditions:
  • the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\SecurityFolders\v4.0.6012 exists
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\SecurityFolders\v4.1.7609 does not exist
• If it satisfies the conditions above, it will also do the following:
  • modify the following registry entries:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
      AutoAdminLogon = 0
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
      DefaultUserName = ""
  • delete auto-start registry (key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value: Windows Defender Deamon)
  • create registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\SecurityFolders\v4.1.7609
• The script found in the registry entry from the added process and autostart technique will query another registry data (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedScripts value: BIN_01) possibly containing a byte code and execute the code.

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)