Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\W32Time] 'Start' = '00000002'
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop w32time
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllYDbg'
Modifies file system
Creates the following files
- conout$
- <SYSTEM32>\windowspowershell\v1.0\setup28516.com
- C:\csb.ini
- nul
Deletes following files that it created itself
- <SYSTEM32>\windowspowershell\v1.0\setup28516.com
Network activity
Connects to
- 'localhost':49693
TCP
Other
- 'localhost':49693
- 'localhost':49694
UDP
- DNS ASK 1.##.#ool.ntp.org
- DNS ASK 0.##.#ool.ntp.org
- DNS ASK ke##uth.win
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\setup28516.com'
Executes the following
- '<SYSTEM32>\cmd.exe' /c del *.com /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Prefetch\* /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del %TEMP%\* /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del %appdata%\Microsoft\Windows\Recent\* /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c fsutil usn deletejournal /d C: >nul 2>&1
- '<SYSTEM32>\fsutil.exe' usn deletejournal /d C
- '<SYSTEM32>\cmd.exe' /c w32tm /query /peers >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /query /peers
- '<SYSTEM32>\cmd.exe' /c sc config w32time start=auto >nul 2>&1
- '<SYSTEM32>\sc.exe' config w32time start=auto
- '<SYSTEM32>\cmd.exe' /c w32tm /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org, 1.us.pool.ntp.org, 2.us.pool.ntp.org, 3.us.pool.ntp.org" >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org, 1.us.pool.ntp.org, 2.us.pool.ntp.org, 3.us.pool.ntp.org"
- '<SYSTEM32>\cmd.exe' /c w32tm /config /reliable:yes >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /config /reliable:yes
- '<SYSTEM32>\cmd.exe' /c net stop w32time >nul 2>&1
- '<SYSTEM32>\net1.exe' stop w32time
- '<SYSTEM32>\cmd.exe' /c net start w32time >nul 2>&1
- '<SYSTEM32>\net.exe' start w32time
- '<SYSTEM32>\net1.exe' start w32time
- '<SYSTEM32>\cmd.exe' /c w32tm /resync /nowait >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /resync /nowait
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<SYSTEM32>\WindowsPowerShell\v1.0\setup28516.com" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<SYSTEM32>\WindowsPowerShell\v1.0\setup28516.com" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<SYSTEM32>\WindowsPowerShell\v1.0\setup28516.com" MD5 | find /i /v "md5" | find /i /v "certutil"' (with hidden window)
