Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ewService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ewService] 'ImagePath' = '%WINDIR%\Client.exe'
Creates the following services
- 'ewService' %WINDIR%\Client.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop ewService
Modifies file system
Creates the following files
- %TEMP%\nss369b.tmp\nsprocess.dll
- %TEMP%\nss369b.tmp\nsexec.dll
- %WINDIR%\parameters.ini
- %WINDIR%\proceslist.txt
- %WINDIR%\client.exe
- %WINDIR%\7zip.exe
- %WINDIR%\gpu_name.txt
- %WINDIR%\warning.txt
Sets the 'hidden' attribute to the following files
- %WINDIR%\client.exe
- %WINDIR%\parameters.ini
Deletes the following files
- %TEMP%\nss369b.tmp\nsexec.dll
- %TEMP%\nss369b.tmp\nsprocess.dll
Network activity
Connects to
- '21#.#9.58.195':17890
TCP
Other
- '21#.#9.58.195':17890
Miscellaneous
Creates and executes the following
- '%WINDIR%\client.exe'
- '%WINDIR%\syswow64\cmd.exe' /C net stop ewService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C Sc delete ewService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C Sc create ewService binpath= %WINDIR%\Client.exe start= auto DisplayName= ewService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc description ewService ServiceManagerw' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc failure ewService reset= 3600 actions= restart/60000/restart/60000/restart/60000' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C net start ewService' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C net stop ewService
- '%WINDIR%\syswow64\net1.exe' stop ewService
- '%WINDIR%\syswow64\cmd.exe' /C Sc delete ewService
- '%WINDIR%\syswow64\sc.exe' delete ewService
- '%WINDIR%\syswow64\cmd.exe' /C Sc create ewService binpath= %WINDIR%\Client.exe start= auto DisplayName= ewService
- '%WINDIR%\syswow64\sc.exe' create ewService binpath= %WINDIR%\Client.exe start= auto DisplayName= ewService
- '%WINDIR%\syswow64\cmd.exe' /C sc description ewService ServiceManagerw
- '%WINDIR%\syswow64\sc.exe' description ewService ServiceManagerw
- '%WINDIR%\syswow64\cmd.exe' /C sc failure ewService reset= 3600 actions= restart/60000/restart/60000/restart/60000
- '%WINDIR%\syswow64\sc.exe' failure ewService reset= 3600 actions= restart/60000/restart/60000/restart/60000
- '%WINDIR%\syswow64\cmd.exe' /C net start ewService
- '%WINDIR%\syswow64\net.exe' start ewService
- '%WINDIR%\syswow64\net1.exe' start ewService
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_VideoController get name > %WINDIR%\gpu_name.txt
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_VideoController get name
