Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\JPPGFile\shell\open\command] '' = '"<Full path to file>" "%1"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateService' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
Modifies file system
Creates the following files
- nul
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C "schtasks /create /tn \"WindowsUpdateService\" /tr \"<Full path to file>\" /sc onlogon /rl highest /f"
- '<SYSTEM32>\schtasks.exe' /create /tn \"WindowsUpdateService\" /tr \"<Full path to file>\" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /C ver
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command " $adapters = Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } foreach ($adapter in $adapters) { $ipConfig = Get-NetIPAddress -InterfaceInde...
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Volume | Select-Object DriveLetter, FileSystemType, Size, SizeRemaining"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | Where-Object { $_.DisplayName -ne $null } | ForEach-Object { $_.DisplayName ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Get-Clipboard
- '<SYSTEM32>\reg.exe' query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- '<SYSTEM32>\reg.exe' query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- '<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- '<SYSTEM32>\reg.exe' query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
- '<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command " Add-Type -AssemblyName System.Windows.Forms,System.Drawing $bounds = [System.Windows.Forms.SystemInformation]::VirtualScreen $bmp = New-Object Sys...
