Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Far2\Documentation\rus\iexplore.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles(x86)%\Mozilla Firefox\d3dcompiler_47\firefox.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'services' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\services.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%WINDIR%\regedit\explorer.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\Documents and Settings\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%ProgramFiles(x86)%\Mozilla Thunderbird\chrome\icons\default\Idle.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"<SYSTEM32>\C_1250\wininit.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"%ALLUSERSPROFILE%\Package Cache\{e46eca4f-393b-40df-9f49-076faf788d83}\<File name>.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\mdm\mdm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Users\Default\Links\iexplore.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\dmdlgs\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Internet Explorer\JSProfilerCore\iexplore.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"<SYSTEM32>\grpconv\WUDFHost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\PerfLogs\Admin\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wudfhost
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- C:\far2\documentation\rus\iexplore.exe
- %WINDIR%\syswow64\grpconv\480b7989c529f6ff17bde430d81d4770fb5337f5
- C:\perflogs\admin\csrss.exe
- C:\perflogs\admin\886983d96e3d3e31032c679b2d4ea91b6c05afef
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %TEMP%\t7dswa6htx
- %TEMP%\ukxm9fwsj3.bat
- nul
- %TEMP%\ny8lx5sg8l
- %TEMP%\hgj9c4klbh
- %TEMP%\aqrwu8e6oz
- %TEMP%\7muzst8fjs
- %TEMP%\ouxfricfgc
- %TEMP%\ariwjnghw1
- %TEMP%\6djzpcobnb
- %TEMP%\fdufjoefxp
- %TEMP%\5h1tn1yr7f
- %TEMP%\jo9d0enqbi
- %TEMP%\dvurrg3lxi
- %TEMP%\x0pddikfyw
- %TEMP%\nnrbgrdrof
- %TEMP%\axeolkwjcg
- %WINDIR%\syswow64\grpconv\wudfhost.exe
- %TEMP%\os6k8uwxlx
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %ProgramFiles(x86)%\mozilla thunderbird\chrome\icons\default\6ccacd8608530fba3a93e87ae2225c7032aa18c1
- C:\far2\documentation\rus\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles(x86)%\mozilla firefox\d3dcompiler_47\firefox.exe
- %ProgramFiles(x86)%\mozilla firefox\d3dcompiler_47\0fc223bdacedc38dd6d2772d547ade1563558e92
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\services.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
- %WINDIR%\regedit\explorer.exe
- %WINDIR%\regedit\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- C:\documents and settings\csrss.exe
- C:\documents and settings\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %ProgramFiles(x86)%\mozilla thunderbird\chrome\icons\default\idle.exe
- %WINDIR%\syswow64\c_1250\wininit.exe
- %ProgramFiles(x86)%\internet explorer\jsprofilercore\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %WINDIR%\syswow64\c_1250\560854153607923c4c5f107085a7db67be01f252
- %ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\<File name>.exe
- %ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\ea8cf6bcc00b30cce2d69530a6ce7c7b38f9a200
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\mdm\mdm.exe
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\mdm\559fba5f8e44108851927af432f0edac6117c574
- C:\users\default\links\iexplore.exe
- C:\users\default\links\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %WINDIR%\syswow64\dmdlgs\csrss.exe
- %WINDIR%\syswow64\dmdlgs\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %ProgramFiles(x86)%\internet explorer\jsprofilercore\iexplore.exe
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\csrss.exe
- %TEMP%\3s1p5pnsk9
Deletes the following files
- %TEMP%\t7dswa6htx
- %TEMP%\axeolkwjcg
- %TEMP%\nnrbgrdrof
- %TEMP%\x0pddikfyw
- %TEMP%\dvurrg3lxi
- %TEMP%\jo9d0enqbi
- %TEMP%\5h1tn1yr7f
- %TEMP%\7muzst8fjs
- %TEMP%\fdufjoefxp
- %TEMP%\ariwjnghw1
- %TEMP%\ouxfricfgc
- %TEMP%\aqrwu8e6oz
- %TEMP%\os6k8uwxlx
- %TEMP%\hgj9c4klbh
- %TEMP%\ny8lx5sg8l
- %TEMP%\6djzpcobnb
- %TEMP%\3s1p5pnsk9
Network activity
Connects to
- '17#.#13.81.2':80
TCP
HTTP GET requests
- http://17#.#13.81.2/Externalimagerequestgamewindows.php?px#######################################################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\dmdlgs\csrss.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\uKXM9fWsj3.bat"' (with hidden window)
- '<Full path to file>' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\uKXM9fWsj3.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\Admin\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<SYSTEM32>\grpconv\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\JSProfilerCore\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\dmdlgs\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Users\Default\Links\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\mdm\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Package Cache\{e46eca4f-393b-40df-9f49-076faf788d83}\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<SYSTEM32>\C_1250\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\chrome\icons\default\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\regedit\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Firefox\d3dcompiler_47\firefox.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
