Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MicrosoftMysql
- '%WINDIR%\syswow64\net.exe' stop lanmanserver /y
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.0
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.1
- '%WINDIR%\syswow64\net.exe' stop COMSysCts
- '%WINDIR%\syswow64\net.exe' stop WmiAppSrv
- '%WINDIR%\syswow64\net.exe' stop Bcdefg
- '%WINDIR%\syswow64\net.exe' stop WSSDPSRVS
- '%WINDIR%\syswow64\net.exe' stop "MicrosoftMysql"
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
- '%WINDIR%\syswow64\net.exe' stop "MicrosoftMssql"
Modifies file system
Creates the following files
- %WINDIR%\inf\doublepulsar.dll
- %ProgramFiles%\windowsd\cnli-0.dll
- %ProgramFiles%\windowsd\adfw-2.dll
- %ProgramFiles%\windowsd\adfw.dll
- %ProgramFiles%\windowsd\shellcode.bin
- %ProgramFiles%\windowsd\eternalromance-1.3.0.xml
- %ProgramFiles%\windowsd\eternalromance-1.3.0.fb
- %ProgramFiles%\windowsd\eternalromance-1.3.0.exe
- %ProgramFiles%\windowsd\eternalromance-1.4.0.xml
- %ProgramFiles%\windowsd\eternalromance-1.4.0.fb
- %ProgramFiles%\windowsd\eternalromance-1.4.0.exe
- %ProgramFiles%\windowsd\eternalchampion-2.0.0.xml
- %ProgramFiles%\windowsd\eternalchampion-2.0.0.fb
- %ProgramFiles%\windowsd\eternalchampion-2.0.0.exe
- %ProgramFiles%\windowsd\x86.dll
- %ProgramFiles%\windowsd\x64.dll
- %ProgramFiles%\windowsd\fileftp.exe
- %TEMP%\xsfxdel~.exe
- %WINDIR%\fonts\mysql\zlib1.dll
- %WINDIR%\fonts\mysql\xdvl-0.dll
- %WINDIR%\fonts\mysql\wget.exe
- %WINDIR%\fonts\mysql\ucl.dll
- %WINDIR%\fonts\mysql\tucl-1.dll
- %WINDIR%\fonts\mysql\tufo-2.dll
- %ProgramFiles%\windowsd\cnli-1.dll
- %ProgramFiles%\windowsd\coli-0.dll
- %ProgramFiles%\windowsd\exma.dll
- %ProgramFiles%\windowsd\eternalblue-2.2.0.xml
- %ProgramFiles%\windowsd\eternalblue-2.2.0.fb
- %ProgramFiles%\windowsd\eternalblue-2.2.0.exe
- %ProgramFiles%\windowsd\etebcore-2.x86.dll
- %ProgramFiles%\windowsd\etebcore-2.x64.dll
- %ProgramFiles%\windowsd\etchcore-1.x86.dll
- %ProgramFiles%\windowsd\etchcore-1.x64.dll
- %ProgramFiles%\windowsd\etchcore-0.x86.dll
- %ProgramFiles%\windowsd\etchcore-0.x64.dll
- %ProgramFiles%\windowsd\esteemaudittouch-2.1.0.xml
- %WINDIR%\fonts\mysql\mance.xml
- %ProgramFiles%\windowsd\esteemaudittouch-2.1.0.fb
- %ProgramFiles%\windowsd\esteemaudittouch-2.1.0.exe
- %ProgramFiles%\windowsd\esteemaudit-2.1.0.xml
- %ProgramFiles%\windowsd\esteemaudit-2.1.0.fb
- %ProgramFiles%\windowsd\esteemaudit-2.1.0.exe
- %ProgramFiles%\windowsd\doublepulsar-1.3.1.xml
- %ProgramFiles%\windowsd\doublepulsar-1.3.1.exe
- %ProgramFiles%\windowsd\dmgd-4.dll
- %ProgramFiles%\windowsd\dmgd-1.dll
- %ProgramFiles%\windowsd\crli-0.dll
- %WINDIR%\fonts\mysql\trfo-2.dll
- %WINDIR%\fonts\mysql\trch-1.dll
- %WINDIR%\fonts\mysql\tich-1.dll
- %WINDIR%\fonts\mysql\same.bat
- %WINDIR%\fonts\mysql\wai.bat
- %WINDIR%\fonts\mysql\nei.bat
- %WINDIR%\inf\tem.vbs
- %WINDIR%\inf\demo1.bat
- %WINDIR%\installer\free.bat
- %WINDIR%\installer\fileftps.exe
- %WINDIR%\fonts\mysql\ctfmon.exe
- %WINDIR%\fonts\mysql\eternalblue2.dll
- %WINDIR%\fonts\mysql\eternalblue.dll
- %WINDIR%\fonts\mysql\doublepulsar2.dll
- %WINDIR%\fonts\mysql\doublepulsar.dll
- nul
- <Current directory>\tem.vbs
- %WINDIR%\inf\king.bat
- %WINDIR%\inf\ftps.exe
- %WINDIR%\inf\ctfmon.exe
- %WINDIR%\inf\eternalblue2.dll
- %WINDIR%\inf\eternalblue.dll
- %WINDIR%\inf\doublepulsar2.dll
- %WINDIR%\fonts\mysql\cmd.bat
- %WINDIR%\fonts\mysql\file.txt
- %WINDIR%\fonts\mysql\bat.bat
- %WINDIR%\fonts\mysql\cnli-1.dll
- %WINDIR%\fonts\mysql\tibe-2.dll
- %WINDIR%\fonts\mysql\coli-0.dll
- %WINDIR%\fonts\mysql\taskhost.exe
- %WINDIR%\fonts\mysql\svchost.exe
- %WINDIR%\fonts\mysql\ssleay32.dll
- %WINDIR%\fonts\mysql\puls.xml
- %WINDIR%\fonts\mysql\puls.exe
- %WINDIR%\fonts\mysql\posh-0.dll
- %WINDIR%\fonts\mysql\poad.bat
- %WINDIR%\fonts\mysql\poab.bat
- %WINDIR%\fonts\mysql\p.txt
- %ProgramFiles%\windowsd\etch-0.dll
- %ProgramFiles%\windowsd\exma-1.dll
- %WINDIR%\fonts\mysql\mance.exe
- %WINDIR%\fonts\mysql\load.bat
- %WINDIR%\fonts\mysql\loab.bat
- %WINDIR%\fonts\mysql\libxml2.dll
- %WINDIR%\fonts\mysql\libeay32.dll
- %WINDIR%\fonts\mysql\exma-1.dll
- %WINDIR%\fonts\mysql\eter.xml
- %WINDIR%\fonts\mysql\eter.exe
- %WINDIR%\fonts\mysql\dmgd-4.dll
- %WINDIR%\fonts\mysql\crli-0.dll
- %WINDIR%\fonts\mysql\nanshou.dll
- %ProgramFiles%\windowsd\iconv.dll
Sets the 'hidden' attribute to the following files
- <Current directory>\tem.vbs
- %WINDIR%\fonts\mysql\doublepulsar.dll
- %WINDIR%\fonts\mysql\doublepulsar2.dll
- %WINDIR%\fonts\mysql\eternalblue.dll
- %WINDIR%\fonts\mysql\eternalblue2.dll
- %WINDIR%\inf\tem.vbs
Deletes the following files
- <Current directory>\tem.vbs
- %WINDIR%\fonts\mysql\doublepulsar.dll
- %WINDIR%\fonts\mysql\doublepulsar2.dll
- %WINDIR%\fonts\mysql\eternalblue.dll
- %WINDIR%\fonts\mysql\eternalblue2.dll
- %WINDIR%\inf\ftps.exe
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\fonts\mysql\svchost.exe' install MicrosoftMysql %WINDIR%\Fonts\Mysql\cmd.bat
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\INF\tem.vbs"
- '%WINDIR%\fonts\mysql\svchost.exe' install MicrosoftMysql "%WINDIR%\Fonts\Mysql\cmd.bat"
- '%WINDIR%\fonts\mysql\ctfmon.exe'
- '%WINDIR%\inf\ftps.exe'
- '%WINDIR%\installer\fileftps.exe'
- '%ProgramFiles%\windowsd\fileftp.exe'
- '%WINDIR%\fonts\mysql\svchost.exe' stop "MicrosoftFonts"
- '%WINDIR%\fonts\mysql\svchost.exe' stop "MicrosoftMysql"
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\tem.vbs"
- '%WINDIR%\syswow64\sc.exe' config lanmanserver start= DISABLED 2>nul' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.1' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.0' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop WmiAppSrv' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop WSSDPSRVS' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Installer\Fileftps.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Fonts\Mysql\same.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\inf\demo1.bat' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop Bcdefg' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop COMSysCts' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r -a %WINDIR%\Fonts' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop lanmanserver /y' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete WmiAppSrv' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c md %WINDIR%\Fonts\Mysql' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete SSDPSRVS' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\INF\king.bat' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete MicrosoftMysql' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete lanmanserver' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.0' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.1' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete COMSysCts' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete Bcdefg' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop MicrosoftMysql' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' delete MicrosoftMysql
- '%WINDIR%\syswow64\net1.exe' stop WSSDPSRVS
- '%WINDIR%\syswow64\net1.exe' stop mssecsvc2.1
- '%WINDIR%\syswow64\net1.exe' stop mssecsvc2.0
- '%WINDIR%\syswow64\net1.exe' stop Bcdefg
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Fonts\Mysql\same.bat" "
- '%WINDIR%\syswow64\net1.exe' stop WmiAppSrv
- '%WINDIR%\syswow64\cacls.exe' "%WINDIR%\Fonts\addins" /g everyone:f
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\Fonts\addins /a
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Installer\Fileftps.exe
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\inf\demo1.bat
- '%WINDIR%\syswow64\sc.exe' config lanmanserver start= DISABLED 2>nul
- '%WINDIR%\syswow64\sc.exe' delete SSDPSRVS
- '%WINDIR%\syswow64\sc.exe' delete Bcdefg
- '%WINDIR%\syswow64\attrib.exe' -s -h -r %WINDIR%\Fonts\addins
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe" /f
- '%WINDIR%\syswow64\net1.exe' stop lanmanserver /y
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\Fonts\cd /a
- '%WINDIR%\syswow64\attrib.exe' +s +h +r %WINDIR%\Fonts\addins\Eternalblue.dll
- '%WINDIR%\syswow64\attrib.exe' +s +h +r %WINDIR%\Fonts\addins\Doublepulsar.dll
- '%WINDIR%\syswow64\sc.exe' delete "MicrosoftMssql"
- '%WINDIR%\syswow64\cacls.exe' "%WINDIR%\Fonts\addins\Eternalblue.dll" /g everyone:f
- '%WINDIR%\syswow64\sc.exe' delete "MicrosoftMysql"
- '%WINDIR%\syswow64\sc.exe' delete WmiAppSrv
- '%WINDIR%\syswow64\net1.exe' stop COMSysCts
- '%WINDIR%\syswow64\attrib.exe' -s -h -r %WINDIR%\Fonts\addins\Doublepulsar.dll
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\Fonts\addins\Eternalblue.dll /a
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\Fonts\addins\Doublepulsar.dll /a
- '%WINDIR%\syswow64\net1.exe' user mm123$ /del
- '%WINDIR%\syswow64\net1.exe' stop "MicrosoftMssql"
- '%WINDIR%\syswow64\net.exe' user mm123$ /del
- '%WINDIR%\syswow64\attrib.exe' -s -h -r %WINDIR%\Fonts\addins\Eternalblue.dll
- '%WINDIR%\syswow64\net1.exe' stop "MicrosoftMysql"
- '%WINDIR%\syswow64\sc.exe' delete COMSysCts
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.1
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.0
- '%WINDIR%\syswow64\wevtutil.exe' cl "security"
- '%WINDIR%\syswow64\cmd.exe' /c md %WINDIR%\Fonts\Mysql
- '%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r -a %WINDIR%\Fonts
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\INF\king.bat
- '%WINDIR%\syswow64\net1.exe' stop MicrosoftMysql
- '%WINDIR%\syswow64\wevtutil.exe' cl "windows powershell"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r %WINDIR%\Fonts\cd
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a %WINDIR%\Fonts
- '%WINDIR%\syswow64\cacls.exe' "%WINDIR%\Fonts\Mysql\*.*" /g everyone:f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn At1 /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn At2 /f
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\Fonts\Mysql /a
- '%WINDIR%\syswow64\attrib.exe' -s -h -r %WINDIR%\Fonts\Mysql
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\wevtutil.exe' cl "system"
- '%WINDIR%\syswow64\cacls.exe' "%WINDIR%\Fonts\addins\Doublepulsar.dll" /g everyone:f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /f
- '%WINDIR%\syswow64\takeown.exe' /f <SYSTEM32>\cscript.exe /a
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\SysWOW64\cscript.exe /a
- '%WINDIR%\syswow64\sc.exe' delete lanmanserver
- '%WINDIR%\syswow64\attrib.exe' +s +h +r %WINDIR%\Fonts\Mysql\Eternalblue2.dll
- '%WINDIR%\syswow64\attrib.exe' +s +h +r %WINDIR%\Fonts\Mysql\Eternalblue.dll
- '%WINDIR%\syswow64\attrib.exe' +s +h +r %WINDIR%\Fonts\Mysql\Doublepulsar2.dll
- '%WINDIR%\syswow64\attrib.exe' +s +h +r %WINDIR%\Fonts\Mysql\Doublepulsar.dll
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\SysWOW64\wscript.exe /a
- '%WINDIR%\syswow64\ping.exe' 127.1 -n 5
- '%WINDIR%\syswow64\cacls.exe' "%WINDIR%\Fonts\Mysql" /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\wscript.exe /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\cscript.exe /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\SysWOW64\wscript.exe /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\SysWOW64\cscript.exe /g everyone:f
- '%WINDIR%\syswow64\takeown.exe' /f <SYSTEM32>\wscript.exe /a
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe" /f
- '%WINDIR%\syswow64\cacls.exe' "%WINDIR%\Fonts\cd" /g everyone:f
