Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%WINDIR%\xdwd.dll'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%APPDATA%\Microsoft\Windows\Templates\xdwdQuickBooks.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RuntimeBroker.exe' = '%WINDIR%\xdwdAutodesk Revit.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\autodesk maya host
- <SYSTEM32>\tasks\inkscape upgrade
Malicious functions
Patches code
in NTDLL dll
- wmiapsrv.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\templates\xdwdquickbooks.exe
- %WINDIR%\xdwdautodesk revit.exe
- %WINDIR%\xdwd.dll
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\templates\xdwdquickbooks.exe
- %WINDIR%\xdwdautodesk revit.exe
Network activity
Connects to
- 'tc##.#unnel4.com':36027
TCP
Other
- 'tc##.#unnel4.com':36027
UDP
- DNS ASK tc##.#unnel4.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Maya Host" /tr "%APPDATA%\Microsoft\Windows\Templates\xdwdQuickBooks.exe" & exit
- '<SYSTEM32>\schtasks.exe' /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Maya Host" /tr "%APPDATA%\Microsoft\Windows\Templates\xdwdQuickBooks.exe"
- '<SYSTEM32>\cmd.exe' /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome Update" /tr "%APPDATA%\Microsoft\Windows\Templates\xdwdQuickBooks.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo -1 /tn "Google Chrome Update" /tr "%APPDATA%\Microsoft\Windows\Templates\xdwdQuickBooks.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c SchTaSKs /create /f /sc minute /mo 5 /tn "Inkscape Upgrade" /tr "%WINDIR%\xdwdAutodesk Revit.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 5 /tn "Inkscape Upgrade" /tr "%WINDIR%\xdwdAutodesk Revit.exe" /RL HIGHEST
- '<SYSTEM32>\wbem\wmiapsrv.exe'
