Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow protocol=tcp profile=public
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow protocol=udp profile=public
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow protocol=tcp profile=public
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow protocol=udp profile=public
Modifies file system
Creates the following files
- %TEMP%\cp9b1nn83z\7z.exe
- %TEMP%\cp9b1nn83z\tools\aria2c.exe
- %TEMP%\cp9b1nn83z\tools\aria2cxp.exe
- %TEMP%\cp9b1nn83z\tools\bcdedit.exe
- %TEMP%\cp9b1nn83z\tools\bootice.exe
- %TEMP%\cp9b1nn83z\tools\bootsect.exe
- %TEMP%\cp9b1nn83z\tools\devcon.exe
- %TEMP%\cp9b1nn83z\tools\fbinst.exe
- %TEMP%\cp9b1nn83z\tools\fbinsttweak.exe
- %TEMP%\cp9b1nn83z\tools\gdisk.exe
- %TEMP%\cp9b1nn83z\download\minithunderplatform.exe
- %TEMP%\cp9b1nn83z\download\minitpfw.exe
- %TEMP%\cp9b1nn83z\tools\oscdimg.exe
- %TEMP%\cp9b1nn83z\tools\pecmd.exe
- %TEMP%\cp9b1nn83z\tools\qemu\qemu.exe
- %TEMP%\cp9b1nn83z\tools\ultraiso.exe
- %TEMP%\cp9b1nn83z\jsy6d33.tmp
- %TEMP%\cp9b1nn83z\download\xlbugreport.exe
- %TEMP%\cp9b1nn83z\download\atl71.dll
- %TEMP%\cp9b1nn83z\download\dl_peer_id.dll
- %TEMP%\cp9b1nn83z\download\download_engine.dll
- %TEMP%\cp9b1nn83z\tools\qemu\libpdcurses.dll
- %TEMP%\cp9b1nn83z\tools\qemu\libssp-0.dll
- %TEMP%\cp9b1nn83z\tools\qemu\libz-1.dll
- %TEMP%\cp9b1nn83z\download\minizip.dll
- %TEMP%\cp9b1nn83z\download\msvcp71.dll
- %TEMP%\cp9b1nn83z\download\msvcr71.dll
- %TEMP%\cp9b1nn83z\tools\qemu\sdl.dll
- %TEMP%\cp9b1nn83z\download\xlbughandler.dll
- %TEMP%\cp9b1nn83z\xldl.dll
- %TEMP%\cp9b1nn83z\download\zlib1.dll
- %TEMP%\cp9b1nn83z\tools\boot.sdi
- %TEMP%\cp9b1nn83z\download\thunderfw.exe
- %TEMP%\cp9b1nn83z\tools\bootmgr.exe.mui
- %TEMP%\cp9b1nn83z\tools\qemu\efi32.bin
- %TEMP%\cp9b1nn83z\7z.dll
- %TEMP%\cp9b1nn83z\tools\10bcd
- %TEMP%\cp9b1nn83z\tools\10efibcd
- %TEMP%\cp9b1nn83z\tools\11bcd
- %TEMP%\cp9b1nn83z\tools\11efibcd
- %TEMP%\cp9b1nn83z\tools\7bcd
- %TEMP%\cp9b1nn83z\tools\8bcd
- %TEMP%\cp9b1nn83z\tools\8efibcd
- %TEMP%\cp9b1nn83z\tools\bcd
- %TEMP%\cp9b1nn83z\tools\bootm7r
- %TEMP%\cp9b1nn83z\tools\bootmgr
- %TEMP%\cp9b1nn83z\tools\bootmhr
- %TEMP%\cp9b1nn83z\tools\waldr
- %TEMP%\cp9b1nn83z\tools\qemu\bios.bin
- %TEMP%\cp9b1nn83z\tools\qemu\efi64.bin
- %TEMP%\cp9b1nn83z\tools\menuud3.lst
- %TEMP%\cp9b1nn83z\tools\efisys.bin
- D:\jsyos\softinfo.ini
- %TEMP%\cp9b1nn83z\tools\uiv2hdd.bin
- %TEMP%\cp9b1nn83z\tools\qemu\vgabios-stdvga.bin
- %TEMP%\cp9b1nn83z\tools\qemu\hd.vmdk
- %TEMP%\cp9b1nn83z\tools\uikey.ini
- %TEMP%\cp9b1nn83z\tools\chs_boot.ttf
- %TEMP%\cp9b1nn83z\tools\wgl4_boot.ttf
- %TEMP%\cp9b1nn83z\tools\etfsboot.com
- %TEMP%\cp9b1nn83z\download\id.dat
- %TEMP%\cp9b1nn83z\tools\iwll.dat
- %TEMP%\cp9b1nn83z\tools\ventoy.dat
- %TEMP%\cp9b1nn83z\tools\bootmgfw.efi
- %TEMP%\cp9b1nn83z\tools\menu.lst
- %TEMP%\cp9b1nn83z\tools\bootmgfw.efi.mui
- %TEMP%\cp9b1nn83z\encoemjsy.ini
Sets the 'hidden' attribute to the following files
- D:\jsyos\softinfo.ini
Deletes the following files
- %TEMP%\cp9b1nn83z\encoemjsy.ini
- %TEMP%\cp9b1nn83z\jsy6d33.tmp
Network activity
Connects to
- 'js#.##witboy.com':80
- 'tj###.klmsdn.com':80
- 'js.##ers.51.la':80
- 'tj#.##hentong.cn':80
- 'ia.#1.la':80
TCP
HTTP GET requests
- http://js#.##witboy.com/wllinfo/oemuqd/uqdoemjsy.dat
- http://tj###.klmsdn.com/?uq#############################################
- http://js.##ers.51.la/21442145.js
- http://tj###.klmsdn.com/?uq##############################################################
- http://tj###.klmsdn.com/?uq#####################################################
- http://ia.#1.la/go1?id###########################################################################################################################################################################...
- http://tj###.klmsdn.com/?uq####################################################################################
- http://tj###.klmsdn.com/?uq##############################################
HTTP POST requests
- http://tj#.##hentong.cn/piwik.php
UDP
- DNS ASK js#.##witboy.com
- DNS ASK tj###.klmsdn.com
- DNS ASK js.##ers.51.la
- DNS ASK tj#.##hentong.cn
- DNS ASK ia.#1.la
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\cp9b1nn83z\download\minithunderplatform.exe' -StartTP
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name = "技术员U启动"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name = "技术员U启动"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow protocol=tcp profile=public
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow protocol=udp profile=public
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow protocol=tcp profile=public
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow protocol=udp profile=public
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name = "技术员U启动"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow protocol=tcp profile=public' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\tools\aria2c.exe" action=allow protocol=udp profile=public' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow protocol=tcp profile=public' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name = "技术员U启动" dir=in program = "%TEMP%\cP9b1NN83Z\download\MiniThunderPlatform.exe" action=allow protocol=udp profile=public' (with hidden window)
