Analysis by: Wilbert Vidal
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel: Dropped by other malware, Downloaded from the Internet

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 61,440 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 10 Jan 2018
Payload: Wipes MBR data, Terminates processes, Restarts system

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

  • %Windows%\0123456789
  • %Windows%\dimens.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

  • csrss.exe
  • wininit.exe
  • winlogon.exe
  • lsass.exe

Other Details

This Trojan does the following:

  • Wipes Master Boot Record Data
    • It overwrites the portion of the physical drives with null values
  • Rename and overwrite files before deletion
    • It avoids deleting files found in the following folders:
      • WINNT
      • Users
      • Windows
      • Program Files
      • Program Files (x86)
      • ProgramData
      • Recovery
      • $Recycle.Bin
      • System Volume Information
      • Windows.old
      • PerfLogs
    • It also does not delete files in the system drive.
  • Force reboots the system

  SOLUTION

Minimum Scan Engine: 9.850
FIRST VSAPI PATTERN FILE: 13.898.04
FIRST VSAPI PATTERN DATE: 11 Jan 2018
VSAPI OPR PATTERN File: 13.899.00
VSAPI OPR PATTERN Date: 12 Jan 2018

NOTES:

Restore the system from backup or reinstall the operating system (OS).

Depending on the extent of the damage, and if the wiping of the MBR is unsuccessful, the system can be made bootable by doing a system repair using a Windows installer disk. If the Windows installer can still make the system boot up, recovery of the files will be futile as portions of the files were already corrupted.


Did this description help? Tell us how we did.