Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %APPDATA%\Microsoft\Protect\ConexantPerformanceMonitor.exe'
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %APPDATA%\microsoft\protect\conexantperformancemonitor.exe
- %TEMP%\dsc1b63.tmp\current
- %TEMP%\dsc1b63.tmp\log
- %TEMP%\dsc1b63.tmp\manifest-000001
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\protect\conexantperformancemonitor.exe
Deletes following files that it created itself
- %TEMP%\dsc1b63.tmp\current
- %TEMP%\dsc1b63.tmp\log
- %TEMP%\dsc1b63.tmp\manifest-000001
Network activity
Connects to
- 'ap#.#pify.org':443
- 'di###rd.cyou':80
TCP
HTTP POST requests
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di###rd.cyou
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-first-run --noerrdialogs --disable-background-networking
