Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\qsaxbplxzmpzlaafoinoliyb
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\lwzgNMvLmtiftshTLJICQczU] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\lwzgNMvLmtiftshTLJICQczU] 'ImagePath' = 'cmd /c cd /d "C:\Drivers\mX" && start "" "C:\Drivers\mX\ABffXGu6op.exe"'
Creates the following services
- 'lwzgNMvLmtiftshTLJICQczU' cmd /c cd /d "C:\Drivers\mX" && start "" "C:\Drivers\mX\ABffXGu6op.exe"
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM ABffXGu6op.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM installer.exe /T
Modifies file system
Creates the following files
- %TEMP%\is-pqvgb.tmp\<File name>.tmp
- %TEMP%\is-s8i1u.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s8i1u.tmp\_isetup\_shfoldr.dll
- C:\drivers\mx\is-vpn9i.tmp
- C:\drivers\mx\is-pb9nu.tmp
- C:\drivers\mx\is-4u792.tmp
- C:\drivers\mx\is-ol9cv.tmp
- C:\drivers\mx\is-sp47o.tmp
- C:\drivers\mx\is-4e3hs.tmp
- C:\drivers\mx\is-bc5pq.tmp
- C:\drivers\disdxy\is-09lbo.tmp
- C:\drivers\disdxy\is-mj0oo.tmp
- C:\drivers\disdxy\is-falpv.tmp
- C:\drivers\disdxy\is-plj19.tmp
- C:\drivers\disdxy\is-vshc3.tmp
- C:\drivers\disdxy\is-hve1b.tmp
- C:\drivers\disdxy\is-3lu7u.tmp
- C:\drivers\5sld\is-hirm6.tmp
- %HOMEPATH%\desktop\app.lnk
- C:\drivers\drivers.dat.0
- C:\drivers\drivers.dat
- \device\namedpipe\ntsvcs
Sets the 'hidden' attribute to the following files
- C:\drivers\5sld\wx.ox
- C:\drivers\disdxy\installer.exe
- C:\drivers\disdxy\展示视频_01.mp4
- C:\drivers\disdxy\展示视频_02.mp4
- C:\drivers\disdxy\素材图片_01.png
- C:\drivers\disdxy\素材图片_02.png
- C:\drivers\disdxy\背景音频_01.mp3
- C:\drivers\disdxy\背景音频_02.mp3
- C:\drivers\mx\abffxgu6op.exe
- C:\drivers\mx\msvcp140.dll
- C:\drivers\mx\msvcp140_1.dll
- C:\drivers\mx\t7qbiyaa.mjj
- C:\drivers\mx\vcruntime140.dll
- C:\drivers\mx\vcruntime140_1.dll
- C:\drivers\mx\wemeet_base.dll
- C:\drivers\drivers.dat
- C:\drivers\drivers.dat.0
Deletes following files that it created itself
- %TEMP%\is-s8i1u.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s8i1u.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-pqvgb.tmp\<File name>.tmp
Moves the following files
- from C:\drivers\mx\is-vpn9i.tmp to C:\drivers\mx\abffxgu6op.exe
- from C:\drivers\mx\is-pb9nu.tmp to C:\drivers\mx\msvcp140.dll
- from C:\drivers\mx\is-4u792.tmp to C:\drivers\mx\msvcp140_1.dll
- from C:\drivers\mx\is-ol9cv.tmp to C:\drivers\mx\t7qbiyaa.mjj
- from C:\drivers\mx\is-sp47o.tmp to C:\drivers\mx\vcruntime140.dll
- from C:\drivers\mx\is-4e3hs.tmp to C:\drivers\mx\vcruntime140_1.dll
- from C:\drivers\mx\is-bc5pq.tmp to C:\drivers\mx\wemeet_base.dll
- from C:\drivers\disdxy\is-09lbo.tmp to C:\drivers\disdxy\installer.exe
- from C:\drivers\disdxy\is-mj0oo.tmp to C:\drivers\disdxy\展示视频_01.mp4
- from C:\drivers\disdxy\is-falpv.tmp to C:\drivers\disdxy\展示视频_02.mp4
- from C:\drivers\disdxy\is-plj19.tmp to C:\drivers\disdxy\素材图片_01.png
- from C:\drivers\disdxy\is-vshc3.tmp to C:\drivers\disdxy\素材图片_02.png
- from C:\drivers\disdxy\is-hve1b.tmp to C:\drivers\disdxy\背景音频_01.mp3
- from C:\drivers\disdxy\is-3lu7u.tmp to C:\drivers\disdxy\背景音频_02.mp3
- from C:\drivers\5sld\is-hirm6.tmp to C:\drivers\5sld\wx.ox
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-pqvgb.tmp\<File name>.tmp' /SL5="$1001DE,126837112,119296,<Full path to file>"
- 'C:\drivers\mx\abffxgu6op.exe'
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"
- '<SYSTEM32>\icacls.exe' \"C:\Drivers\" /deny Users:(D)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
- '<SYSTEM32>\icacls.exe' \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
- '<SYSTEM32>\attrib.exe' C:\Drivers +s +h
- '<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D
- '<SYSTEM32>\schtasks.exe' /create /tn QsaXBPLxZMpzLaAfOinOliyB /tr "cmd /c cd /d \"C:\Drivers\mX\" && start \"\" \"C:\Drivers\mX\ABffXGu6op.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
- '%WINDIR%\syswow64\taskkill.exe' /F /IM ABffXGu6op.exe /T' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM installer.exe /T' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"' (with hidden window)
- '<SYSTEM32>\attrib.exe' C:\Drivers +s +h' (with hidden window)
- '<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn QsaXBPLxZMpzLaAfOinOliyB /tr "cmd /c cd /d \"C:\Drivers\mX\" && start \"\" \"C:\Drivers\mX\ABffXGu6op.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f' (with hidden window)
