Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram"<Full path to file>" "<File name>" ENABLE
Modifies file system
Creates the following files
- %APPDATA%\recovery.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\recovery.exe
Network activity
Connects to
- 'ci#######ditions.gl.at.ply.gg':15765
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/xml/?fi######################
Other
- 'ci#######ditions.gl.at.ply.gg':15765
UDP
- DNS ASK ci#######ditions.gl.at.ply.gg
- DNS ASK ip##pi.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "<File name>" /tr "<Full path to file>"
- '<SYSTEM32>\taskeng.exe' {2E3BAEF7-6B47-4BF5-B21F-CBD1E68848A1} S-1-5-21-3150914307-1777937420-491476919-1000:eznoygrlpjsd\user:Interactive:[1]
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram"<Full path to file>" "<File name>" ENABLE' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "<File name>" /tr "<Full path to file>"' (with hidden window)
- '<Full path to file>' ' (with hidden window)
