Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Client.exe' = '"%APPDATA%\Client.exe" ..'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Client.exe' = '"%APPDATA%\Client.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\client.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\client.url
- <SYSTEM32>\tasks\microsoftedgeupdatetaskmachine
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM cmd.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wscript.exe
- '<SYSTEM32>\taskkill.exe' /f im Wireshark.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %APPDATA%\client.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\client.exe
- %APPDATA%\client.exe
Deletes the following files
- <SYSTEM32>\tasks\microsoftedgeupdatetaskmachine
Network activity
Connects to
- 'so####p.at.ply.gg':17209
UDP
- DNS ASK so####p.at.ply.gg
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\client.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM cmd.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM wscript.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f im Wireshark.exe' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr %APPDATA%\Client.exe' (with hidden window)
- '%APPDATA%\client.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 5
- '<SYSTEM32>\schtasks.exe' /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr %APPDATA%\Client.exe
- '<SYSTEM32>\taskeng.exe' {DC0C5D81-F922-49B4-A4BA-17C56DB1DD60} S-1-5-21-1238866942-1249195528-555854008-1000:igyvnql\user:Interactive:[1]
