Technical Information
Triggers a user-defined sigma rule:
- a1a144b7-5c9b-4853-a559-2172be8d4a03
- 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
- 92626ddd-662c-49e3-ac59-f6535f12d189
- 7a02e22e-b885-4404-b38b-1ddc7e65258a
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4hzgey80b3' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\wkyj3h90ql
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\notepad.exe
Modifies file system
Creates the following files
- %APPDATA%\a64ce17f0000ca47\1
- %APPDATA%\a64ce17f0000ca47\time
- %APPDATA%\a64ce17f0000ca47\group
- %APPDATA%\a64ce17f0000ca47\hwid
- %APPDATA%\a64ce17f0000ca47\settingtime
- %APPDATA%\a64ce17f0000ca47\filter
- %APPDATA%\a64ce17f0000ca47\network
- %APPDATA%\a64ce17f0000ca47\plug\1\f1e6cb395f81461a9a58f3b1d6049609
- %APPDATA%\a64ce17f0000ca47\version
Network activity
Connects to
- '38.##.125.96':5289
TCP
Other
- '38.##.125.96':5289
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN "wkyj3h90ql" /TR "\"<Full path to file>\"" /SC ONLOGON /RL HIGHEST /F /DELAY 0000:30
- '<SYSTEM32>\schtasks.exe' /Create /TN "wkyj3h90ql" /TR "\"<Full path to file>\"" /SC ONLOGON /RL HIGHEST /F /DELAY 0000:30
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN "wkyj3h90ql" /TR "\"<Full path to file>\"" /SC ONLOGON /RL HIGHEST /F /DELAY 0000:30' (with hidden window)
