Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\SIVDriver] 'ImagePath' = '<DRIVERS>\SIVX64.sys'
Creates the following services
- 'SIVDriver' <DRIVERS>\SIVX64.sys
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop RpcSs
- '%WINDIR%\syswow64\net.exe' stop wmiApSrv
- '%WINDIR%\syswow64\net.exe' stop RpcLocator
- '%WINDIR%\syswow64\net.exe' stop DcomLaunch
Modifies file system
Creates the following files
- %TEMP%\nsr60b6.tmp
- %WINDIR%\logs\sysinfo\tools\www.samlab.ws.url
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\actions.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\process.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\devices.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\crashes.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\!bsod!.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\execute.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\startup.htm
- %WINDIR%\logs\sysinfo\tools\logs\2021_06_21__16_16_32__mubbdcxui_log.txt
- %WINDIR%\logs\sysinfo\tools\logs\2021_06_21__16_16_46__mubbdcxui_state.snp
- %WINDIR%\logs\sysinfo\tools\mubbdcxui.html
- %WINDIR%\logs\sysinfo\tools\hwids.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\drivers.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\system\dxdiag.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\drivers.html
- <DRIVERS>\sivx64.sys
- %WINDIR%\temp\udd8b1f.tmp
- %WINDIR%\temp\udd934a.tmp
- %WINDIR%\logs\sysinfo\tools\siv_dbgout.log
- %WINDIR%\logs\sysinfo\tools\siv_mubbdcxui.txt
- %WINDIR%\temp\udd9b57.tmp
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\system\setupapi.dev.log
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\hwids.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\mubbdcxui.html
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\siv_mubbdcxui.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sdi-logs\2021_06_21__16_16_46__mubbdcxui_state.snp
- %WINDIR%\logs\sysinfo\tools\log.exe
- %WINDIR%\logs\sysinfo\tools\error.bug
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\error.bug
- %WINDIR%\logs\sysinfo\tools\wput.exe
- %WINDIR%\logs\sysinfo\mubbdcxui_2021.06.21_support.txt
- %WINDIR%\logs\sysinfo\tools\usbdevs.txt
- %WINDIR%\logs\sysinfo\tools\pcmdevs.txt
- %TEMP%\nsr60b7.tmp\system.dll
- %TEMP%\nsr60b7.tmp\modern-header.bmp
- %TEMP%\nsr60b7.tmp\nsprocess.dll
- %WINDIR%\logs\sysinfo\tools\7za.exe
- %WINDIR%\logs\sysinfo\tools\appcrashview.exe
- %WINDIR%\logs\sysinfo\tools\bluescreenview.exe
- %WINDIR%\logs\sysinfo\tools\boxcutter.exe
- %WINDIR%\logs\sysinfo\tools\cprocess.exe
- %WINDIR%\logs\sysinfo\tools\devmanview.exe
- %WINDIR%\logs\sysinfo\tools\driverview.exe
- %WINDIR%\logs\sysinfo\tools\driverview64.exe
- %WINDIR%\logs\sysinfo\tools\executedprogramslist.exe
- %WINDIR%\logs\sysinfo\tools\hwids.cmd
- %WINDIR%\logs\sysinfo\tools\installeddriverslist.exe
- %WINDIR%\logs\sysinfo\tools\installeddriverslist64.exe
- %WINDIR%\logs\sysinfo\tools\lastactivityview.exe
- %WINDIR%\logs\sysinfo\tools\sdi-drv.exe
- %WINDIR%\logs\sysinfo\tools\siv32x.exe
- %WINDIR%\logs\sysinfo\tools\siv64x.exe
- %WINDIR%\logs\sysinfo\tools\sivx32.sys
- %WINDIR%\logs\sysinfo\tools\sivx64.sys
- %WINDIR%\logs\sysinfo\tools\sysinf.bat
- %WINDIR%\logs\sysinfo\tools\whatinstartup.exe
- %WINDIR%\logs\sysinfo\tools\winaudit.exe
- %WINDIR%\logs\sysinfo\tools\devcon.exe
- %WINDIR%\logs\sysinfo\tools\fix_dll.cmd
- %WINDIR%\logs\sysinfo\tools\hidec.exe
- %WINDIR%\logs\sysinfo\tools\mondevs.txt
- %WINDIR%\logs\sysinfo\tools\pcidevs.txt
- %WINDIR%\logs\sysinfo\tools\pnpdevs.txt
- %WINDIR%\logs\sysinfo\sysinfo.7z
Deletes the following files
- %WINDIR%\temp\udd8b1f.tmp
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\startup.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\siv_mubbdcxui.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\process.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\mubbdcxui.html
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\hwids.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\execute.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\drivers.html
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\system\dxdiag.txt
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\drivers.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\crashes.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\actions.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\!bsod!.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sdi-logs\2021_06_21__16_16_46__mubbdcxui_state.snp
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\error.bug
- %WINDIR%\temp\udd9b57.tmp
- %WINDIR%\temp\udd934a.tmp
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\sysinfo\devices.htm
- %WINDIR%\logs\sysinfo\logs\mubbdcxui\system\setupapi.dev.log
Moves the following files
- from %WINDIR%\logs\sysinfo\sysinfo.7z to %WINDIR%\logs\sysinfo\mubbdcxui_2021.06.21_support.7z
Network activity
Connects to
- 'microsoft.com':80
- 'oc##.#tartssl.com':80
- 'ap#.##infodb.com':80
- 'oc##.thawte.com':80
UDP
- DNS ASK microsoft.com
- DNS ASK oc##.#tartssl.com
- DNS ASK ap#.##infodb.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK oc##.thawte.com
Miscellaneous
Searches for the following windows
- ClassName: 'MPWClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\logs\sysinfo\tools\lastactivityview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Actions.htm
- '%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find hid*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find usb*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find acpi*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' status *
- '%WINDIR%\logs\sysinfo\tools\installeddriverslist64.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Drivers.html
- '%WINDIR%\logs\sysinfo\tools\driverview64.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Drivers.htm
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find hdaudio*
- '%WINDIR%\logs\sysinfo\tools\siv64x.exe' -SAVE[devices][device-ids][dimms][driver-vsn][environment][hw-status][interfaces][my-ip-address][overview][pnp-dev][processes][startup][software][system][uaa-dev]
- '%WINDIR%\logs\sysinfo\tools\log.exe' /S /C
- '%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\SysInf.bat
- '%WINDIR%\logs\sysinfo\tools\7za.exe' a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\
- '%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\7za a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' hwids *CC_01* *Raid*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find =net
- '%WINDIR%\logs\sysinfo\tools\cprocess.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Process.htm
- '%WINDIR%\logs\sysinfo\tools\sdi-drv.exe' -nogui -autoclose
- '%WINDIR%\logs\sysinfo\tools\devmanview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Devices.htm
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find pci*
- '%WINDIR%\logs\sysinfo\tools\bluescreenview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\!BSOD!.htm
- '%WINDIR%\logs\sysinfo\tools\appcrashview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Crashes.htm
- '%WINDIR%\logs\sysinfo\tools\executedprogramslist.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Execute.htm
- '%WINDIR%\logs\sysinfo\tools\whatinstartup.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\Startup.htm
- '%WINDIR%\logs\sysinfo\tools\winaudit.exe' /r=gz /o=HTML
- '%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
- '%WINDIR%\logs\sysinfo\tools\bluescreenview.exe' /scomma %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\SysInfo\!BSOD!.txt
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\SysInf.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd' (with hidden window)
- '%WINDIR%\logs\sysinfo\tools\7za.exe' a -t7z %WINDIR%\Logs\SysInfo\SysInfo.7z %WINDIR%\Logs\SysInfo\LOGs\' (with hidden window)
Executes the following
- '<SYSTEM32>\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\System\DxDiag.txt
- '%WINDIR%\syswow64\findstr.exe' .
- '%WINDIR%\syswow64\more.com' +1
- '%WINDIR%\syswow64\findstr.exe' /n .
- '%WINDIR%\syswow64\cmd.exe' /c WMIC COMPUTERSYSTEM GET TotalPhysicalMemory /VALUE|FindStr .|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' COMPUTERSYSTEM GET TotalPhysicalMemory /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c WMIC OS GET Caption,CSDVersion /FORMAT:CSV|FindStr .|More +1|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' OS GET Caption,CSDVersion /FORMAT:CSV
- '%WINDIR%\syswow64\cmd.exe' /c WMIC CPU GET Name,MaxClockSpeed /FORMAT:CSV|FindStr .|More +1|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' CPU GET Name,MaxClockSpeed /FORMAT:CSV
- '%WINDIR%\syswow64\cmd.exe' /c WMIC BASEBOARD GET Manufacturer,Product /FORMAT:CSV|FindStr .|More +1|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' BIOS GET Manufacturer,Name /FORMAT:CSV
- '%WINDIR%\syswow64\cmd.exe' /c WMIC DISKDRIVE Where InterfaceType='IDE' GET Model /VALUE|FindStr .|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' DISKDRIVE Where InterfaceType='IDE' GET Model /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c WMIC path Win32_VideoController GET Name,AdapterRAM /FORMAT:CSV|FindStr .|More +1|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_VideoController GET Name,AdapterRAM /FORMAT:CSV
- '%WINDIR%\syswow64\cmd.exe' /c WMIC path Win32_NetworkAdapter Where "AdapterTypeId=0 And NetConnectionStatus=2" GET Name /VALUE|FindStr .|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_NetworkAdapter Where "AdapterTypeId=0 And NetConnectionStatus=2" GET Name /VALUE
- '%WINDIR%\syswow64\wbem\wmic.exe' BASEBOARD GET Manufacturer,Product /FORMAT:CSV
- '%WINDIR%\syswow64\cmd.exe' /c WMIC BIOS GET Manufacturer,Name /FORMAT:CSV|FindStr .|More +1|FindStr /n .
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\SysInf.bat
- '%WINDIR%\syswow64\net1.exe' start DcomLaunch
- '%WINDIR%\syswow64\net.exe' start DcomLaunch
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.css" /v "Content Type" /t reg_sz /d text/css /f
- '%WINDIR%\syswow64\net1.exe' stop RpcSs
- '%WINDIR%\syswow64\net1.exe' stop wmiApSrv
- '%WINDIR%\syswow64\net1.exe' stop RpcLocator
- '%WINDIR%\syswow64\net1.exe' stop DcomLaunch
- '%WINDIR%\syswow64\sc.exe' config RpcSs start=auto
- '%WINDIR%\syswow64\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\mubbdcxui\System\DxDiag.txt
- '%WINDIR%\syswow64\sc.exe' config wmiApSrv start=auto
- '%WINDIR%\syswow64\sc.exe' config DcomLaunch start=auto
- '%WINDIR%\syswow64\net.exe' start RpcSs
- '%WINDIR%\syswow64\net1.exe' start RpcSs
- '%WINDIR%\syswow64\net.exe' start wmiApSrv
- '%WINDIR%\syswow64\net1.exe' start wmiApSrv
- '%WINDIR%\syswow64\net.exe' start RpcLocator
- '%WINDIR%\syswow64\net1.exe' start RpcLocator
- '<SYSTEM32>\locator.exe'
- '%WINDIR%\syswow64\sc.exe' config RpcLocator start=auto
- '%WINDIR%\syswow64\cmd.exe' /c WMIC path Win32_SoundDevice GET Name /VALUE|FindStr .|FindStr /n .
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_SoundDevice GET Name /VALUE
