Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft assisant
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\microsoftassisant.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\microsoftassisant.exe.log
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\microsoftassisant.exe
Network activity
Connects to
- '77.#3.134.3':8080
- 'ip##o.is':80
TCP
HTTP GET requests
- http://ip##o.is/
UDP
- DNS ASK ip##o.is
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\microsoftassisant.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /create /TN "Microsoft Assisant" /TR "%ALLUSERSPROFILE%\Microsoft\MicrosoftAssisant.exe" /sc ONLOGON
- '%WINDIR%\syswow64\schtasks.exe' /create /TN "Microsoft Assisant" /TR "%ALLUSERSPROFILE%\Microsoft\MicrosoftAssisant.exe" /sc ONLOGON
- '%WINDIR%\syswow64\explorer.exe' %ALLUSERSPROFILE%\Microsoft\MicrosoftAssisant.exe
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /create /TN "Microsoft Assisant" /TR "%ALLUSERSPROFILE%\Microsoft\MicrosoftAssisant.exe" /sc ONLOGON' (with hidden window)
- '%WINDIR%\syswow64\explorer.exe' %ALLUSERSPROFILE%\Microsoft\MicrosoftAssisant.exe' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\microsoftassisant.exe' ' (with hidden window)
