Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '¸ßÇåÎúÒôƵ¹ÜÀГÆ÷' = 'C:\Users\Public\Documents\Windows\RuntimeBroker.exe'
Modifies file system
Creates the following files
- C:\users\public\documents\windows\runtimebroker.exe
Sets the 'hidden' attribute to the following files
- C:\users\public\documents\windows\runtimebroker.exe
Network activity
Connects to
- '10#.#31.14.104':80
- '10#.#31.14.104':83
TCP
HTTP GET requests
- http://10#.#31.14.104/www
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- 'C:\users\public\documents\windows\runtimebroker.exe'
Executes the following
- 'C:\users\public\documents\windows\runtimebroker.exe' ' (with hidden window)
