Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\11635a06df7b8efd9a15327e9206fd43] 'ImagePath' = '"%ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe"'
- [HKLM\System\CurrentControlSet\Services\11635a06df7b8efd9a15327e9206fd43] 'Start' = '00000002'
Creates the following services
- '11635a06df7b8efd9a15327e9206fd43' "%ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe"
- '11635a06df7b8efd9a15327e9206fd43' %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\nsjaa82.tmp\system.dll
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\1318622ff8c79c8f6a3dc796f6b3fd9c.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\e628bd0e4b49f8e4e578d5a6109c975b.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\797720df9f79ad22e2e63384f58d1134.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\a330bcfa92b9eb8308f59c937a74ccff.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\2b981629b9cf61d163ba504fc0e0884b.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\8882f269206774ccc32c2aa2de21972b
- %TEMP%\ima1c56.tmp
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\585a21bd4c5bf9794cb9ff78398b8a60\gyhdlyin.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wien\signin with twitter.lnk
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\585a21bd4c5bf9794cb9ff78398b8a60\vftpriqt.dll
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe
- %WINDIR%\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\733e39220c319e9861e5a4bb68452e04\c069d00a2acc5cf939e895860a03a2bb.ico
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\733e39220c319e9861e5a4bb68452e04\ef7d3e53b4a1e795adfe318331d33fdf.ico
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\733e39220c319e9861e5a4bb68452e04\5846ff67b0eafe02e90430615c8b6422.ico
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wien\wajam website.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wien\settings.lnk
- %TEMP%\nsjaa82.tmp\simplesc.dll
- %WINDIR%\temp\ima2348.tmp
- %ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\c069d00a2acc5cf939e895860a03a2bb.ico
- %TEMP%\nstd03a.tmp\system.dll
- %TEMP%\nsjaa82.tmp\md5dll.dll
- %TEMP%\getsid.bat
- %TEMP%\nsjaa82.tmp\nsexec.dll
- %TEMP%\nsjaa82.tmp\nsislist.dll
- %TEMP%\nsjaa82.tmp\brh.dll
- %TEMP%\nsjaa82.tmp\moreinfo.dll
- %TEMP%\nsjaa82.tmp\inetc.dll
- %TEMP%\nsyc562.tmp
- %TEMP%\nstd03a.tmp\nsislist.dll
- %TEMP%\nsyff93.tmp\md5dll.dll
- %TEMP%\nstd03a.tmp\simplesc.dll
- %TEMP%\nstd03a.tmp\stdutils.dll
- %TEMP%\nstd03a.tmp\md5dll.dll
- %TEMP%\nstd03a.tmp\nsisos.dll
- %TEMP%\nsyff93.tmp\system.dll
- %TEMP%\nsyff93.tmp\nsislist.dll
- %TEMP%\nsyff93.tmp\simplesc.dll
- %TEMP%\nsyff93.tmp\stdutils.dll
- %TEMP%\nsyff93.tmp\nsexec.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wien\uninstall wajam\uninstall.lnk
Deletes the following files
- %TEMP%\getsid.bat
- %TEMP%\nsjaa82.tmp\nsislist.dll
- %TEMP%\nsjaa82.tmp\nsexec.dll
- %TEMP%\nsjaa82.tmp\moreinfo.dll
- %TEMP%\nsjaa82.tmp\md5dll.dll
- %TEMP%\nsjaa82.tmp\inetc.dll
- %TEMP%\nsjaa82.tmp\brh.dll
- %WINDIR%\temp\ima2348.tmp
- %TEMP%\ima1c56.tmp
- %TEMP%\nsyc562.tmp
- %TEMP%\nsyff93.tmp\system.dll
- %TEMP%\nsyff93.tmp\stdutils.dll
- %TEMP%\nsyff93.tmp\simplesc.dll
- %TEMP%\nsyff93.tmp\nsislist.dll
- %TEMP%\nsyff93.tmp\nsexec.dll
- %TEMP%\nsyff93.tmp\md5dll.dll
- %TEMP%\nstd03a.tmp\system.dll
- %TEMP%\nstd03a.tmp\stdutils.dll
- %TEMP%\nstd03a.tmp\simplesc.dll
- %TEMP%\nstd03a.tmp\nsisos.dll
- %TEMP%\nstd03a.tmp\nsislist.dll
- %TEMP%\nstd03a.tmp\md5dll.dll
- %TEMP%\nsjaa82.tmp\simplesc.dll
- %TEMP%\nsjaa82.tmp\system.dll
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
Network activity
UDP
- DNS ASK te#######ieadrienprovencher.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\nsyc562.tmp' /S /UPDATE /DLL /SID S-1-5-21-3691498038-2086406363-2140527554-1000 _?=%LOCALAPPDATA%\Temp
- '%TEMP%\nsyc562.tmp' /S /UPDATE /PROXY /SID S-1-5-21-3691498038-2086406363-2140527554-1000 _?=%LOCALAPPDATA%\Temp
- '%ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe' --install
- '%ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\GetSID.bat
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "IMAGENAME eq explorer.exe" /FO LIST /V
- '%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq explorer.exe" /FO LIST /V
- '%WINDIR%\syswow64\wbem\wmic.exe' useraccount where name='user' get sid
- '%WINDIR%\syswow64\sc.exe' delete "0"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\4d8b79becb539b8405e3dc74747ebbbb" /f /v "DisplayIcon" /t REG_SZ /d "%WINDIR%\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\4d8b79becb539b8405e3dc74747ebbbb" /f /v "UninstallString" /t REG_SZ /d "%WINDIR%\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\GetSID.bat' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete "0"' (with hidden window)
- '%ProgramFiles%\4d8b79becb539b8405e3dc74747ebbbb\271e6afb0a8e1fefbcae1ae3e1d78a63.exe' --install' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\4d8b79becb539b8405e3dc74747ebbbb" /f /v "DisplayIcon" /t REG_SZ /d "%WINDIR%\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe"' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\4d8b79becb539b8405e3dc74747ebbbb" /f /v "UninstallString" /t REG_SZ /d "%WINDIR%\eb3baa4f8d30fedbfa3bcee5eef2d5e6.exe"' (with hidden window)
