Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- <SYSTEM32>\tasks\iexplore__-pu
- %APPDATA%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- <SYSTEM32>\tasks\firefox__-pu
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\iexplore__-pu] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\iexplore__-pu] 'ImagePath' = 'C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\firefox__-pu] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\firefox__-pu] 'ImagePath' = 'C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\iexplore__-pu] 'ImagePath' = 'C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe'
Creates the following services
- 'iexplore__-pu' C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- 'firefox__-pu' C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- 'iexplore__-pu' C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM iexplore__.exe /F
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes
- '<SYSTEM32>\taskkill.exe' /IM firefox__.exe /F
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=out action=allow program="C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=in action=allow program="C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes
Modifies file system
Creates the following files
- C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcx1482.tmp
- C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcx155e.tmp
- C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcx15fb.tmp
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\payload\publisher.zip
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\payload\publisher32.dll
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\payload\publisher64.dll
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\cfg
- %ALLUSERSPROFILE%\exec_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\payload\monitor.zip
- %ALLUSERSPROFILE%\exec_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\payload\commander32.dll
- %ALLUSERSPROFILE%\exec_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\payload\commander64.dll
- %ALLUSERSPROFILE%\exec_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\cfg
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx380b.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx38a8.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx3936.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4c90.tmp
- C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4cfe.tmp
- C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4d6d.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx6470.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx64fe.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx659b.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx7c8f.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx7d0d.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx7d8b.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx9059.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx90b8.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx9126.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa56a.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa5e8.tmp
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa676.tmp
Deletes following files that it created itself
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\payload\publisher.zip
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\payload\publisher32.dll
- %ALLUSERSPROFILE%\prox_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\proxy\payload\publisher64.dll
- %ALLUSERSPROFILE%\exec_tyrbcci-rhw8xlqvnoa33vogk1es-9oyc78davznykw\payload\monitor.zip
- <SYSTEM32>\tasks\iexplore__-pu
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- <SYSTEM32>\tasks\firefox__-pu
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
Moves the following files
- from C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcx1482.tmp to C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- from C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcx155e.tmp to C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- from C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcx15fb.tmp to C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx380b.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx38a8.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx3936.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4c90.tmp to C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4cfe.tmp to C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4d6d.tmp to C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx64fe.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx659b.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx7d0d.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx7d8b.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx90b8.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx9126.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa5e8.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa676.tmp to C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
Substitutes the following files
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
Network activity
Connects to
- 'ap#.#ithub.com':443
- 'oc##.#ectigo.com':80
- 're#########ets.githubusercontent.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0f##############
Other
- 'ap#.#ithub.com':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
UDP
- DNS ASK ap#.#ithub.com
- DNS ASK oc##.#ectigo.com
- DNS ASK gi##ub.com
- DNS ASK re#########ets.githubusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\net.exe' start
- '<SYSTEM32>\net1.exe' start
- '<SYSTEM32>\sc.exe' delete iexplore__-pu
- '<SYSTEM32>\schtasks.exe' /delete /tn "iexplore__-pu" /f
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' delete firefox__-pu
- '<SYSTEM32>\schtasks.exe' /delete /tn "firefox__-pu" /f
- '<SYSTEM32>\sc.exe' create "firefox__-pu" binPath= "C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox__-pu" /tr "C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' query "firefox__-pu"
- '<SYSTEM32>\sc.exe' query "iexplore__-pu"
- '<SYSTEM32>\net.exe' start' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM iexplore__.exe /F' (with hidden window)
- '<SYSTEM32>\sc.exe' delete iexplore__-pu' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "iexplore__-pu" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\c3eb387d\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM firefox__.exe /F' (with hidden window)
- '<SYSTEM32>\sc.exe' delete firefox__-pu' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "firefox__-pu" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create "firefox__-pu" binPath= "C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=out action=allow program="C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=in action=allow program="C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox__-pu" /tr "C:\c3eb387d\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\c3eb387d\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\sc.exe' query "firefox__-pu"' (with hidden window)
- '<SYSTEM32>\sc.exe' query "iexplore__-pu"' (with hidden window)
