Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yupjetlhugrx' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\cotHe\dwm.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\plvgyhu
- %APPDATA%\Microsoft\windows\Start Menu\programs\startup\mdaims.lnk
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmstp.exe
- <SYSTEM32>\osk.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\rdpinit.exe
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\1xasymng\version.dll
- %LOCALAPPDATA%\1xasymng\cmstp.exe
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\gxoiipc\version.dll
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\gxoiipc\cmstp.exe
- %LOCALAPPDATA%\chm3ytn\dxgi.dll
- %LOCALAPPDATA%\chm3ytn\dwm.exe
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\cothe\dxgi.dll
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\cothe\dwm.exe
- %LOCALAPPDATA%\jfg1jsrt\wtsapi32.dll
- %LOCALAPPDATA%\jfg1jsrt\rdpinit.exe
- %APPDATA%\microsoft\templates\livecontent\16\l8otmbygmc\wtsapi32.dll
- %APPDATA%\microsoft\templates\livecontent\16\l8otmbygmc\rdpinit.exe
Modifies the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\f58155b4b1d5a524ca0261c3ee99fb50_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
Network activity
Connects to
- 'ap#.msn.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?36##############
Other
- 'ap#.msn.com':443
UDP
- DNS ASK ap#.msn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\1xasymng\cmstp.exe'
- '%LOCALAPPDATA%\chm3ytn\dwm.exe'
- '%LOCALAPPDATA%\jfg1jsrt\rdpinit.exe'
- '%APPDATA%\Microsoft\windows\Start Menu\programs\Telegram Desktop\gxoiipc\cmstp.exe' Menu\programs\Telegram Desktop\gxoiipc\cmstp.exe
Executes the following
- '%WINDIR%\explorer.exe'
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
