Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\hwinfo32setup
- <SYSTEM32>\tasks\hwinfo32monitor
Malicious functions
Patches code
in NTDLL dll
- programa.exe process, ntdll.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\hwinfo32\lu.tmp
- %APPDATA%\hwinfo32\update.log
- %APPDATA%\hwinfo32\turbojpeg.dll
- %APPDATA%\hwinfo32\webview2loader.dll
Deletes following files that it created itself
- <SYSTEM32>\tasks\hwinfo32setup
Moves the following files
- from %APPDATA%\hwinfo32\lu.tmp to %APPDATA%\hwinfo32\programa.exe
Network activity
Connects to
- 'ap#.##oudflare.com':443
- '21#.#29.88.53':80
- 'dl.#####oxusercontent.com':443
- 'ms####nnecttest.com':80
- 'ap#.#pify.org':443
- 'ip##pi.com':80
- '19#.#99.75.154':9000
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?38##############
- http://www.ms####nnecttest.com/connecttest.txt
Other
- 'ap#.##oudflare.com':443
- 'dl.#####oxusercontent.com':443
- 'ap#.#pify.org':443
- '19#.#99.75.154':9000
UDP
- DNS ASK ap#.##oudflare.com
- DNS ASK dl.#####oxusercontent.com
- DNS ASK ms####nnecttest.com
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
- DNS ASK 66.##.##.185.in-addr.arpa
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%APPDATA%\hwinfo32\programa.exe'
- '%APPDATA%\hwinfo32\programa.exe' --uiaccess
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "HWiNFO32Setup" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "HWiNFO32Monitor" /TR "%APPDATA%\HWiNFO32\programa.exe"
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "HWiNFO32Setup"
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "HWiNFO32Setup" /TR "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /SC ONLOGON /RL HIGHEST /TN "HWiNFO32Monitor" /TR "%APPDATA%\HWiNFO32\programa.exe"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "HWiNFO32Setup"' (with hidden window)
- '%APPDATA%\hwinfo32\programa.exe' --uiaccess' (with hidden window)
