TROJ_CRYPWALL.YY

This Trojan deletes the initially executed copy of itself.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System Root%\(8 random characters)\{8 random characters}.exe
• %Application Data%\(8 random characters).exe
• %User Startup%\(8 random characters).exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{8 random characters} = "%System Root%\(8 random characters)\{8 random characters}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{8 random characters}c = "%Application Data%\{8 random characters}.exe"

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\(8 random characters).exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = 4

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = 4

(Note: The default value data of the said registry entry is 2.)

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}s.com/img4.php
• {BLOCKED}flymedia.az/img2.php
• {BLOCKED}rniainsuranceco.com/img4.php
• {BLOCKED}seniordogfood.com/img2.php
• {BLOCKED}nblowdri.com/img4.php
• {BLOCKED}lassn.com/volunteer/img1.php
• {BLOCKED}.net/plus/img1.php
• {BLOCKED}voplasma.com/televisa/img1.php
• {BLOCKED}-score-repair-help.com/img4.php
• {BLOCKED}rack.com/img2.php
• {BLOCKED}ctor.com/img3.php
• {BLOCKED}members.com/img4.php
• {BLOCKED}ondock.com/img2.php
• {BLOCKED}utions.net/img5.php
• {BLOCKED}chluy.net/utf.php
• {BLOCKED}shersreviews.org/img3.php
• {BLOCKED}olve.com/img2.php
• {BLOCKED}igninc.net/img3.php
• {BLOCKED}ligames.org/img1.php
• {BLOCKED}ithere.com/tools/img2.php
• {BLOCKED}wncarandlimousine.com/img1.php
• {BLOCKED}eaparchitects.com/img4.php
• {BLOCKED}ashlaundry.com/wp-content/img1.php
• {BLOCKED}lawoffice.com/img1.php
• {BLOCKED}ski.com/img5.php
• {BLOCKED}ideosonline.net/img2.php
• {BLOCKED}.com/img3.php
• {BLOCKED}apan.com/img3.php
• {BLOCKED}sm.net/img4.php
• {BLOCKED}bo.org/img5.php
• {BLOCKED}up.net/img5.php
• {BLOCKED}ns.com/img4.php
• {BLOCKED}olistic.com/img1.php
• {BLOCKED}f.com/img4.php
• {BLOCKED}ngela.com/img5.php
• {BLOCKED}-club.net/img3.php
• {BLOCKED}ldakariri.net/img2.php
• {BLOCKED}rt.net/img2.php
• {BLOCKED}alestateinvestor.com/img1.php
• {BLOCKED}com/img5.php
• {BLOCKED}usmetalsrarecoininvestments.com/img2.php
• {BLOCKED}a.com/img1.php
• {BLOCKED}orseoservices.com.au/img5.php

It deletes the initially executed copy of itself

NOTES:

This Trojan drops the following files in the folder where encrypted files are:

• HELP_DECRYPT.TXT
• HELP_DECRYPT.HTML
• HELP_DECRYPT.URL
• HELP_DECRYPT.PNG