Technical Information
Modifies file system
Creates the following files
- %HOMEPATH%\documents\fbczdb.exe
- %HOMEPATH%\documents\etoken.dll
- %HOMEPATH%\documents\perfi.db
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\documents\fbczdb.exe
- %HOMEPATH%\documents\etoken.dll
- %HOMEPATH%\documents\perfi.db
Network activity
Connects to
- 'r8####.###-cn-beijing.aliyuncs.com':443
TCP
Other
- '34.##9.100.209':443
- 'r8####.###-cn-beijing.aliyuncs.com':443
UDP
- DNS ASK r8####.###-cn-beijing.aliyuncs.com
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\documents\fbczdb.exe'
Executes the following
- '<SYSTEM32>\taskeng.exe' {5656ADE5-5DA9-4B81-BC0A-8A6E6CEA076F} S-1-5-21-3691498038-2086406363-2140527554-1000:klnrjx\user:Interactive:[1]
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%HOMEPATH%\Docu...
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%HOMEPATH%\Documents\" /t REG_DWORD...
- '%HOMEPATH%\documents\fbczdb.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%HOMEPATH%\Docu...' (with hidden window)
