Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft-7d15db02e7' = '%ProgramFiles(x86)%\Microsoft\Temp\Microsoft-7d15db02e7.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\system-7d15db02e7
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\424234.exe
- %TEMP%\ixp000.tmp\fsafasf.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\424234.exe.log
- <SYSTEM32>\system-7d15db02e7.exe
- %WINDIR%\syswow64\$lmx-7d15db02e7.exe
- %ProgramFiles(x86)%\microsoft\temp\microsoft-7d15db02e7.exe
Deletes following files that it created itself
- %TEMP%\ixp000.tmp\fsafasf.exe
- %TEMP%\ixp000.tmp\424234.exe
Network activity
Connects to
- 'i.##b.co':443
- 'x1.#.lencr.org':80
- '19#.#32.210.172':80
- 'google.com':80
- 'sy###icloud.com':443
- '19#.#32.214.172':80
- 'r1#.#.lencr.org':80
- 'pa###snap.com':443
- 'pr####tretrac.com':443
- 'mo#####.map.fastly.net':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?65##############
- http://r1#.#.lencr.org/25.crl
- http://r1#.#.lencr.org/53.crl
Other
- 'i.##b.co':443
- 'eo###rtnite.com':443
UDP
- DNS ASK i.##b.co
- DNS ASK x1.#.lencr.org
- DNS ASK google.com
- DNS ASK sy###icloud.com
- DNS ASK r1#.#.lencr.org
- DNS ASK br####ogecoin.com
- DNS ASK de#####hunter.com.de
- DNS ASK pa###snap.com
- DNS ASK eo###rtnite.com
- DNS ASK pr####tretrac.com
- DNS ASK Fe#####dForever.org.ru
- DNS ASK le####gworld.top
- DNS ASK in##rte.top
- DNS ASK Co####stersHub.su
- DNS ASK in####nferno.top
- DNS ASK sp#####tvieidusha.ru
- DNS ASK Te######uresFromRussia.su
- DNS ASK ad####eautyz.top
- DNS ASK fl##mi.top
- DNS ASK Le#####CodeWithUs.su
- DNS ASK ti#####onlinestore.top
- DNS ASK Ru###chHub.ru
- DNS ASK co####rforum.com
- DNS ASK bu####gspice.cfd
- DNS ASK ga####glimmer.top
- DNS ASK ru######ulturalheritage.ru
- DNS ASK wi###ify.com
- DNS ASK bl###ullet.su
- DNS ASK Ex#####RussiaBeyond.ru
- DNS ASK Yo####xtBigIdea.su
- DNS ASK se####textweb.cc
- DNS ASK cr####vecoder.top
- DNS ASK ga####ategames.top
- DNS ASK na###ell.sbs
- DNS ASK wa###assage.cfd
- DNS ASK Ru######echInnovationHub.ru
- DNS ASK jo###ontext.top
- DNS ASK Su#####FromWithin.ru
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\424234.exe'
- '%TEMP%\ixp000.tmp\fsafasf.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /CREATE /TN "System-7d15db02e7" /TR "<SYSTEM32>\System-7d15db02e7.exe" /SC ONLOGON /RL HIGHEST /F
- '%TEMP%\ixp000.tmp\424234.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\fsafasf.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /TN "System-7d15db02e7" /TR "<SYSTEM32>\System-7d15db02e7.exe" /SC ONLOGON /RL HIGHEST /F' (with hidden window)
