Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im BluescreenSimulator.exe
Modifies file system
Creates the following files
- %TEMP%\2.exe
- %TEMP%\_mei11482\select.pyd
- %TEMP%\_mei11482\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei16922\base_library.zip
- %TEMP%\_mei16922\_socket.pyd
- %TEMP%\_mei20922\libffi-8.dll
- %TEMP%\_mei16922\_lzma.pyd
- %TEMP%\_mei29682\libcrypto-3.dll
- %TEMP%\_mei11482\python313.dll
- %TEMP%\_mei16922\libcrypto-3.dll
- %TEMP%\_mei11482\libffi-8.dll
- %TEMP%\_mei29682\base_library.zip
- %TEMP%\_mei29682\_socket.pyd
- %TEMP%\_mei20922\libcrypto-3.dll
- %TEMP%\_mei20922\base_library.zip
- %TEMP%\_mei20922\_socket.pyd
- %TEMP%\_mei16922\_hashlib.pyd
- %TEMP%\_mei20922\_decimal.pyd
- %TEMP%\_mei29682\libffi-8.dll
- %TEMP%\_mei16922\select.pyd
- %TEMP%\_mei29682\win32\win32gui.pyd
- %TEMP%\_mei16922\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei29682\win32\win32api.pyd
- %TEMP%\_mei29682\unicodedata.pyd
- %TEMP%\_mei29682\select.pyd
- %TEMP%\_mei29682\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei29682\_lzma.pyd
- %TEMP%\_mei11482\unicodedata.pyd
- %TEMP%\_mei20922\win32\win32gui.pyd
- %TEMP%\_mei20922\unicodedata.pyd
- %TEMP%\_mei20922\select.pyd
- %TEMP%\_mei11482\win32\win32gui.pyd
- %TEMP%\_mei11482\win32\win32api.pyd
- %TEMP%\_mei20922\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei29682\python313.dll
- %TEMP%\_mei16922\libffi-8.dll
- %TEMP%\_mei20922\python313.dll
- %TEMP%\_mei16922\_decimal.pyd
- %TEMP%\_mei29682\_hashlib.pyd
- %TEMP%\_mei29682\_decimal.pyd
- %TEMP%\start.bat
- %TEMP%\_mei11482\_ctypes.pyd
- %TEMP%\_mei11482\_bz2.pyd
- %TEMP%\_mei11482\vcruntime140_1.dll
- %TEMP%\_mei11482\vcruntime140.dll
- %TEMP%\ixp000.tmp\bluescreensimulator.exe
- %TEMP%\1.mp3
- %TEMP%\_mei16922\unicodedata.pyd
- %TEMP%\_mei20922\vcruntime140.dll
- %TEMP%\sound.vbs
- %TEMP%\shake.exe
- %TEMP%\msvcr100d.dll
- %TEMP%\msvcp100d.dll
- %TEMP%\fake.exe
- %TEMP%\4.exe
- %TEMP%\3.exe
- %TEMP%\1.exe
- %TEMP%\_mei16922\python313.dll
- %TEMP%\_mei20922\vcruntime140_1.dll
- %TEMP%\_mei20922\_bz2.pyd
- %TEMP%\_mei11482\_hashlib.pyd
- %TEMP%\_mei11482\libcrypto-3.dll
- %TEMP%\_mei16922\_ctypes.pyd
- %TEMP%\_mei20922\_lzma.pyd
- %TEMP%\_mei29682\_ctypes.pyd
- %TEMP%\_mei16922\_bz2.pyd
- %TEMP%\_mei20922\_hashlib.pyd
- %TEMP%\_mei11482\_lzma.pyd
- %TEMP%\_mei16922\vcruntime140_1.dll
- %TEMP%\_mei11482\_decimal.pyd
- %TEMP%\_mei16922\vcruntime140.dll
- %TEMP%\_mei11482\base_library.zip
- %TEMP%\_mei29682\vcruntime140_1.dll
- %TEMP%\_mei20922\_ctypes.pyd
- %TEMP%\_mei11482\_socket.pyd
- %TEMP%\_mei29682\vcruntime140.dll
- %TEMP%\_mei29682\_bz2.pyd
- %TEMP%\_mei16922\win32\win32gui.pyd
Deletes the following files
- %TEMP%\ixp000.tmp\bluescreensimulator.exe
Modifies the following files
- %LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'WMPlayerApp' WindowName: ''
Creates and executes the following
- '%TEMP%\fake.exe'
- '%TEMP%\ixp000.tmp\bluescreensimulator.exe' --win10
- '<SYSTEM32>\wscript.exe' "%TEMP%\sound.vbs"
- '%TEMP%\shake.exe'
- '%TEMP%\1.exe'
- '%TEMP%\2.exe'
- '%TEMP%\3.exe'
- '%TEMP%\4.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\start.bat" "
- '<SYSTEM32>\timeout.exe' /t 10
- '<SYSTEM32>\cmd.exe' /c BluescreenSimulator.exe --win10
- '<SYSTEM32>\cmd.exe' /c BluescreenSimulator.exe --win10' (with hidden window)
