Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'wmiprvse' = '%APPDATA%\PLAYRE~1\wmiprvse.exe'
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %APPDATA%\playready\TeamViewer_Resource_en.dll
on window messages:
- Handler for all processes: %APPDATA%\PlayReady\tv_x64.dll
- Handler for all processes: %APPDATA%\PlayReady\tv_w32.dll
Modifies file system
Creates the following files
- %TEMP%\ns-4rkmt.tmp\ns-m1sre.tmp
- %APPDATA%\playready\v4rlxk6cm.bat
- %APPDATA%\playready\tv_x64.exe
- %APPDATA%\playready\tv_x64.dll
- %APPDATA%\playready\tv_w32.exe
- %APPDATA%\playready\tv_w32.dll
- %APPDATA%\playready\teamviewer_staticres.dll
- %APPDATA%\playready\teamviewer_resource_en.dll
- %APPDATA%\playready\teamviewer_desktop.exe
- %APPDATA%\playready\teamviewer.ini
- %APPDATA%\playready\msi.dll
- %APPDATA%\playready\467m2q1m.cfg
- %TEMP%\q5vxch51\ns-rds0e.tmp
- %APPDATA%\playready\wd6cdtkn.bmp
- %TEMP%\q5vxch51\ns-m9u6m.tmp
- %TEMP%\q5vxch51\ns-k6rfb.tmp
- %TEMP%\q5vxch51\ns-sursk.tmp
- %TEMP%\q5vxch51\ns-ar3qh.tmp
- %TEMP%\q5vxch51\ns-02oip.tmp
- %TEMP%\q5vxch51\ns-lpd1l.tmp
- %TEMP%\q5vxch51\ns-srhgt.tmp
- %TEMP%\q5vxch51\ns-64tmd.tmp
- %TEMP%\q5vxch51\ns-dlnqh.tmp
- %TEMP%\q5vxch51\ns-apjck.tmp
- %TEMP%\q5vxch51\ns-go60g.tmp
- %TEMP%\ns-qu5kg.tmp\_iscrypt.dll
- %TEMP%\ns-qu5kg.tmp\_shfoldr.dll
- %TEMP%\q5vxch51\ns-b95m6.tmp
- %APPDATA%\playready\wmiprvse.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\playready\msi.dll
- %APPDATA%\playready\teamviewer.ini
- %APPDATA%\playready\teamviewer_desktop.exe
- %APPDATA%\playready\teamviewer_resource_en.dll
- %APPDATA%\playready\teamviewer_staticres.dll
- %APPDATA%\playready\tv_w32.dll
- %APPDATA%\playready\tv_w32.exe
- %APPDATA%\playready\tv_x64.dll
- %APPDATA%\playready\tv_x64.exe
- %APPDATA%\playready\wmiprvse.exe
Deletes the following files
- %TEMP%\ns-qu5kg.tmp\_iscrypt.dll
- %TEMP%\ns-qu5kg.tmp\_shfoldr.dll
- %TEMP%\ns-4rkmt.tmp\ns-m1sre.tmp
- %TEMP%\q5vxch51\467m2q1m.cfg
- %TEMP%\q5vxch51\msi.dll
- %TEMP%\q5vxch51\tv_w32.dll
- %TEMP%\q5vxch51\tv_w32.exe
- %TEMP%\q5vxch51\tv_x64.dll
- %TEMP%\q5vxch51\tv_x64.exe
- %TEMP%\q5vxch51\wd6cdtkn.bmp
- %TEMP%\q5vxch51\wmiprvse.exe
- %APPDATA%\playready\wd6cdtkn.bmp
Moves the following files
- from %TEMP%\q5vxch51\ns-go60g.tmp to %TEMP%\q5vxch51\467m2q1m.cfg
- from %TEMP%\q5vxch51\ns-apjck.tmp to %TEMP%\q5vxch51\msi.dll
- from %TEMP%\q5vxch51\ns-dlnqh.tmp to %TEMP%\q5vxch51\teamviewer.ini
- from %TEMP%\q5vxch51\ns-64tmd.tmp to %TEMP%\q5vxch51\teamviewer_desktop.exe
- from %TEMP%\q5vxch51\ns-srhgt.tmp to %TEMP%\q5vxch51\teamviewer_resource_en.dll
- from %TEMP%\q5vxch51\ns-lpd1l.tmp to %TEMP%\q5vxch51\teamviewer_staticres.dll
- from %TEMP%\q5vxch51\ns-02oip.tmp to %TEMP%\q5vxch51\tv_w32.dll
- from %TEMP%\q5vxch51\ns-ar3qh.tmp to %TEMP%\q5vxch51\tv_w32.exe
- from %TEMP%\q5vxch51\ns-sursk.tmp to %TEMP%\q5vxch51\tv_x64.dll
- from %TEMP%\q5vxch51\ns-k6rfb.tmp to %TEMP%\q5vxch51\tv_x64.exe
- from %TEMP%\q5vxch51\ns-b95m6.tmp to %TEMP%\q5vxch51\v4rlxk6cm.bat
- from %TEMP%\q5vxch51\ns-m9u6m.tmp to %TEMP%\q5vxch51\wd6cdtkn.bmp
- from %TEMP%\q5vxch51\ns-rds0e.tmp to %TEMP%\q5vxch51\wmiprvse.exe
Network activity
TCP
HTTP GET requests
- http://go###nish.com/limit/update.php?id################################################
UDP
- DNS ASK pi###.#eamviewer.com
- DNS ASK ma#####.teamviewer.com
- DNS ASK cl####.teamviewer.com
- DNS ASK go###nish.com
- 'ma#####.teamviewer.com':5938
- '18#.#88.32.13':5938
- '10.#.18.2':59625
- '<LOCALNET>.0.103':59625
- '45.##3.88.237':59625
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'TeamViewer Manager'
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\ns-4rkmt.tmp\ns-m1sre.tmp' /SL6 $120228 <Full path to file> 4906994 272384 /password=xu90u9m /verysilent
- '%APPDATA%\playready\wmiprvse.exe'
- '%APPDATA%\playready\tv_w32.exe' --action hooks --deferlog --log %APPDATA%\TeamViewer\
- '%APPDATA%\playready\tv_x64.exe' --action hooks --deferlog --log %APPDATA%\TeamViewer\
- '%APPDATA%\playready\teamviewer_desktop.exe' --IPCport 6039
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\q5vxch51\v4rlxk6cm.bat""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "wmiprvse" /t REG_SZ /F /D "%APPDATA%\PLAYRE~1\wmiprvse.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\q5vxch51\v4rlxk6cm.bat""
- '%WINDIR%\syswow64\xcopy.exe' /Y /I /S "%TEMP%\q5vxch51\*" "%APPDATA%\PlayReady\"
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "wmiprvse" /t REG_SZ /F /D "%APPDATA%\PLAYRE~1\wmiprvse.exe"
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "wmiprvse" /t REG_SZ /F /D "%APPDATA%\PLAYRE~1\wmiprvse.exe"
