Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\tooykupdate
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\YService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\YService] 'ImagePath' = '%WINDIR%\SysWOW64\YKJLFWD\Service.exe /ErrorStdOut -StartS'
Creates the following services
- 'YService' %WINDIR%\SysWOW64\YKJLFWD\Service.exe /ErrorStdOut -StartS
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles%\RealVNC\VNC Server\vncserver.exe" "VNC Server" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" "AnyDesk" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Service.exe" "YService" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Server.exe" "YServer" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\vpn.exe" "YVPN" ENABLE
Modifies file system
Creates the following files
- %TEMP%\aut57a1.tmp
- %TEMP%\auta5a1.tmp
- %TEMP%\992pgtakmo
- %WINDIR%\temp\auta90b.tmp
- %WINDIR%\temp\1216mddkcjz
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
- %WINDIR%\syswow64\ykjlfwd\server.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\a3wa0nsg\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\uw9q2z1j\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\8uh9sn58\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\h4l2gcq4\desktop.ini
- %TEMP%\aut6e05.tmp
- %WINDIR%\syswow64\ykjlfwd\devcon.exe
- %TEMP%\aut6df4.tmp
- %WINDIR%\syswow64\ykjlfwd\vncserver.exe
- %TEMP%\aut6dc5.tmp
- %WINDIR%\syswow64\ykjlfwd\ttvncs.exe
- %TEMP%\aut6d85.tmp
- %WINDIR%\syswow64\ykjlfwd\vpn.exe
- %TEMP%\aut6d75.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %TEMP%\aut6d54.tmp
- %WINDIR%\syswow64\ykjlfwd\service.exe
- %TEMP%\aut6d15.tmp
- %TEMP%\2352hqygpcd
- %TEMP%\aut6b7e.tmp
- %TEMP%\r.tmp
- %TEMP%\1632hmozjdj
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\low\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\a3wa0nsg\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\uw9q2z1j\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\8uh9sn58\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\h4l2gcq4\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut57a1.tmp
- %TEMP%\1632hmozjdj
- %TEMP%\aut6b7e.tmp
- %TEMP%\2352hqygpcd
- %TEMP%\aut6d15.tmp
- %TEMP%\aut6d54.tmp
- %TEMP%\aut6d75.tmp
- %TEMP%\aut6d85.tmp
- %TEMP%\aut6dc5.tmp
- %TEMP%\aut6df4.tmp
- %TEMP%\aut6e05.tmp
- %TEMP%\auta5a1.tmp
- %TEMP%\992pgtakmo
- %WINDIR%\temp\auta90b.tmp
- %WINDIR%\temp\1216mddkcjz
- <SYSTEM32>\tasks\tooykupdate
Deletes itself.
Network activity
Connects to
- 'to##k.com':80
UDP
- DNS ASK to##k.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ykjlfwd\service.exe' /ErrorStdOut -StartS
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /TN TooykUpdate /RU user /SC ONCE /ST 19:55:06 /RL HIGHEST /F /TR "'<Full path to file>' /Task"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c chcp 437 & schtasks /query /tn TooykUpdate > "%TEMP%\r.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /run /TN TooykUpdate /I' (with hidden window)
- '<Full path to file>' /Task' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%ProgramFiles%\RealVNC\VNC Server\vncserver.exe" "VNC Server" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" "AnyDesk" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Service.exe" "YService" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Server.exe" "YServer" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\vpn.exe" "YVPN" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\ykjlfwd\service.exe' /ErrorStdOut -StartS' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /TN TooykUpdate /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /TN TooykUpdate /RU user /SC ONCE /ST 19:55:06 /RL HIGHEST /F /TR "'<Full path to file>' /Task"
- '%WINDIR%\syswow64\schtasks.exe' /delete /TN TooykUpdate /F
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /TN TooykUpdate /F
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\vpn.exe" "YVPN" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Server.exe" "YServer" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Service.exe" "YService" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" "AnyDesk" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%ProgramFiles%\RealVNC\VNC Server\vncserver.exe" "VNC Server" ENABLE
- '<SYSTEM32>\taskeng.exe' {07D2C08E-7168-4A9C-8DEF-3E082B2DF9CF} S-1-5-21-1960123792-2022915161-3775307078-1001:hjvbvjfwzjuj\user:Interactive:[1]
- '%WINDIR%\syswow64\schtasks.exe' /run /TN TooykUpdate /I
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /run /TN TooykUpdate /I
- '%WINDIR%\syswow64\schtasks.exe' /query /tn TooykUpdate
- '%WINDIR%\syswow64\chcp.com' 437
- '%WINDIR%\syswow64\cmd.exe' /c chcp 437 & schtasks /query /tn TooykUpdate > "%TEMP%\r.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /create /TN TooykUpdate /RU user /SC ONCE /ST 19:55:06 /RL HIGHEST /F /TR "'<Full path to file>' /Task"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
