Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn "Admin Folder" /rl highest /tr "'%ProgramFiles%\User\Admin.exe' /startup" /f
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- %TEMP%\times.5t
- %ProgramFiles%\User\Admin.exe
- %APPDATA%\Monitor\Screenshots\03-16-2017\7.08 AM
- %TEMP%\nsg2.tmp
- %TEMP%\work-forte
- %TEMP%\vaghurt-vagina-youghurt-workshop
Network activity:
Connects to:
- 'wx###xia0.com':2354
- 'ty##.#jysxteel.com':2354
UDP:
- DNS ASK wx###xia0.com
- DNS ASK ty##.#jysxteel.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'fault' WindowName: ''
- ClassName: 'cellars' WindowName: ''
- ClassName: 'configuration' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'photographs' WindowName: ''
