Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\q1ggnlt4jzi9
Modifies file system
Creates the following files
- %TEMP%\yma69x8p51k4.exe
- %APPDATA%\microsoft\windows\update\jjuo0sxpmbex.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\yma69x8p51k4.exe
- %APPDATA%\microsoft\windows\update\jjuo0sxpmbex.exe
Network activity
Connects to
- '21#.#27.14.90':5173
Miscellaneous
Creates and executes the following
- '%TEMP%\yma69x8p51k4.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "Q1GgnlT4JzI9" /tr "Q1GgnlT4JzI9" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c timeout /t 2 /nobreak && del /f /q "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 2 /nobreak
- '%TEMP%\yma69x8p51k4.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "Q1GgnlT4JzI9" /tr "Q1GgnlT4JzI9" /sc onlogon /rl highest /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c timeout /t 2 /nobreak && del /f /q "<Full path to file>"' (with hidden window)
