Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windows update listner
- <SYSTEM32>\tasks\microsoft\microsoft launcher
- <SYSTEM32>\tasks\launch adobe ccxprocess
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'ImagePath' = '%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe'
Creates the following services
- 'System Diagnostics Host' %WINDIR%\SysWOW64\SystemDiagnosticsHost.exe
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Window Listner" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\fn2v3kb2.nvd.exe
- %TEMP%\alimentos que ajudan na massoterapia.pptx
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- C:\recovery\oem\resetwindows.exe
- %WINDIR%\media\msldriver.dll
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- %TEMP%\content\4724-1156-fn2v3kb2.nvd.exe-13-31-44-861.dump
- %TEMP%\content\4724-1156-fn2v3kb2.nvd.exe-13-31-45-385.dump
- %TEMP%\03cebz3x.rnc.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\fn2v3kb2.nvd.exe.log
- nul
- %TEMP%\content\672-1592-mppr.exe-13-32-14-752.dump
- %TEMP%\tmp12b4.tmp
- %TEMP%\tmp2301.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\mppr.exe.log
Sets the 'hidden' attribute to the following files
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- C:\recovery\oem\resetwindows.exe
- %WINDIR%\media\msldriver.dll
- %WINDIR%\syswow64\systemdiagnosticshost.exe
Deletes following files that it created itself
- %TEMP%\tmp12b4.tmp
- %TEMP%\tmp2301.tmp
Modifies the HOSTS file.
Network activity
Connects to
- 'localhost':443
UDP
- DNS ASK cv######wgyffrwu9iww6.com
- DNS ASK ww######gyui3s1.hopto.org
- DNS ASK cv######ynwfffgyui2w4.com
- DNS ASK pr######ag32dds.hopto.org
- DNS ASK dw######jfk8ds5.hopto.org
- DNS ASK an######sa9923p.hopto.org
- DNS ASK 2w######jfui309.hopto.org
- DNS ASK vv######gyuigi2.hopto.org
- DNS ASK ui######wgydfhbhuifdf.com
- DNS ASK ug######jhf02jbhdfg9u.com
Miscellaneous
Creates and executes the following
- '%TEMP%\fn2v3kb2.nvd.exe'
- '%WINDIR%\syswow64\systemdiagnosticshost.exe'
- '%WINDIR%\media\mppr.exe'
Executes the following
- '%ProgramFiles(x86)%\microsoft office\office16\powerpnt.exe' "%TEMP%\Alimentos que ajudan na massoterapia.pptx" /ou ""
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon & exit
- '<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
- '<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe"
- '<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe"
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="Window Listner" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon
- '<SYSTEM32>\sc.exe' create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
- '<SYSTEM32>\sc.exe' description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
- '<SYSTEM32>\sc.exe' start "System Diagnostics Host"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\03cebz3x.rnc.bat""
- '<SYSTEM32>\timeout.exe' 8
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "%WINDIR%\Media\mppr.exe" /sc onlogon & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="Window Listner" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit' (with hidden window)
