Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\hjdytuap.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\systray.exe
the following user processes:
- iexplore.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
- %WINDIR%\syswow64\autochk.exe
Modifies file system
Creates the following files
- %HOMEPATH%\s.exe
Deletes the following files
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Network activity
UDP
- DNS ASK ve####ularcorp.com
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\syswow64\cmmon32.exe'
- '%WINDIR%\syswow64\systray.exe'
- '%WINDIR%\syswow64\wscript.exe'
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\raserver.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\cmstp.exe'
- '%WINDIR%\syswow64\napstat.exe'
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\wlanext.exe'
- '%WINDIR%\syswow64\netstat.exe'
- '%WINDIR%\syswow64\wuapp.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
- '%WINDIR%\syswow64\cscript.exe'
- '%WINDIR%\syswow64\netsh.exe'
- '%WINDIR%\syswow64\mstsc.exe'
