Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\magnify.exe
- <SYSTEM32>\osk.exe
- <SYSTEM32>\narrator.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\resmon.resmoncfg
- %LOCALAPPDATA%\speech\microsoft\speech\files\userlexicons\sp_16579028049e4b7eaa7c87ee1e6c5f20.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5ywkpx6u\home[1]
- %APPDATA%\microsoft\speech\files\userlexicons\sp_a1b516d2aa3a4150acc987fea0e876a2.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\bodl519a\views[1]
- %LOCALAPPDATA%\d3dscache\ecbf0d5a3a180bb\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.idx
- %LOCALAPPDATA%\d3dscache\ecbf0d5a3a180bb\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.lock
- %LOCALAPPDATA%\d3dscache\ecbf0d5a3a180bb\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.val
- %LOCALAPPDATA%\speech\microsoft\speech\files\userlexicons\sp_832a68d6623a4ba68c28b1d7800c8019.dat
Network activity
Connects to
- 'we###ok.site':443
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://r1#.#.lencr.org/67.crl
Other
- 'we###ok.site':443
UDP
- DNS ASK we###ok.site
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
- DNS ASK 17#.###.#32.199.in-addr.arpa
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Microsoft-Windows-SnipperCaptureForm-WinShiftS' WindowName: ''
- ClassName: 'Microsoft-Windows-SnipperToolbar' WindowName: ''
- ClassName: 'Microsoft-Windows-SnipperEditor' WindowName: ''
- ClassName: 'Microsoft-Windows-SnipperCaptureForm' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'TaskManagerWindow' WindowName: 'Task Manager'
- ClassName: '' WindowName: 'System Configuration'
Executes the following
- '<SYSTEM32>\calc.exe'
- '<SYSTEM32>\notepad.exe'
- '<SYSTEM32>\mspaint.exe'
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\taskmgr.exe'
- '<SYSTEM32>\control.exe'
- '%WINDIR%\regedit.exe'
- '%ProgramFiles%\windowsapps\microsoft.windowscalculator_10.1906.55.0_x64__8wekyb3d8bbwe\calculator.exe' -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
- '<SYSTEM32>\msconfig.exe'
- '<SYSTEM32>\perfmon.exe'
- '<SYSTEM32>\resmon.exe'
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\perfmon.msc"
- '<SYSTEM32>\eventvwr.exe'
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\services.msc"
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\eventvwr.msc"
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\devmgmt.msc"
- '<SYSTEM32>\cleanmgr.exe'
- '<SYSTEM32>\charmap.exe'
- '<SYSTEM32>\perfmon.exe' /res
- '<SYSTEM32>\magnify.exe'
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\osk.exe'
- '<SYSTEM32>\snippingtool.exe'
- '%ProgramFiles%\windows nt\accessories\wordpad.exe'
- '<SYSTEM32>\mstsc.exe'
- '<SYSTEM32>\narrator.exe'
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\eventvwr.msc"' (with hidden window)
