Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\application experience\tasktrigger
- <SYSTEM32>\tasks\microsoft\windows\application experience\tasktrigger2
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\
Modifies file system
Creates the following files
- %TEMP%\nsec017.tmp
- %TEMP%\nsuc16f.tmp\nsexec.dll
- %TEMP%\nsuc16f.tmp\system.dll
- %TEMP%\nsuc16f.tmp\nh_f6fc92d9618c.nhc
- %APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_f6fc92d9618c
- %TEMP%\nsuc16f.tmp\nh_9e6c3786fcd4.nhc
- %APPDATA%\comain_ev2f79\ntrin.er.nhpart_9e6c3786fcd4
- %TEMP%\nsuc16f.tmp\nh_7e6fc832474b.nhc
- %APPDATA%\comain_ev2f79\otrm.oi.nhpart_7e6fc832474b
- %TEMP%\nsuc16f.tmp\nh_5b066b1843b9.nhc
- %APPDATA%\comain_ev2f79\yinma.vc.nhpart_5b066b1843b9
- %TEMP%\nsuc16f.tmp\nh_114cbc113a9b.nhc
- %APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_114cbc113a9b
- %TEMP%\windowsz.txt
- %TEMP%\nsuc16f.tmp\nh_80e964c871c4.nhc
- %APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_80e964c871c4
- %TEMP%\nsuc16f.tmp\nh_5ff8cf562dd9.nhc
- %APPDATA%\comain_ev2c34\bnymir.ou.nhpart_5ff8cf562dd9
- %TEMP%\nsuc16f.tmp\nh_70ffc2b875a5.nhc
- %APPDATA%\comain_ev2c34\bteuns.pt.nhpart_70ffc2b875a5
- %TEMP%\nsuc16f.tmp\nh_db7e9d6410cf.nhc
- %APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_db7e9d6410cf
- %TEMP%\nsuc16f.tmp\nh_15e595a9976a.nhc
- %APPDATA%\comain_ev2c34\fhkan.oi.nhpart_15e595a9976a
- %TEMP%\nsuc16f.tmp\nh_76994d912e87.nhc
- %APPDATA%\comain_ev2c34\ap.asin.nhpart_76994d912e87
- %APPDATA%\comain_ev2c34\qbdrf\dr.dll
- %ProgramFiles(x86)%\community\baiduwangpan.exe
- %TEMP%\uk_tmp.txt
- %APPDATA%\bnymir.ou
- %APPDATA%\ap.asin
Deletes following files that it created itself
- %TEMP%\nsuc16f.tmp\nh_f6fc92d9618c.nhc
- %TEMP%\nsuc16f.tmp\nh_9e6c3786fcd4.nhc
- %TEMP%\nsuc16f.tmp\nh_7e6fc832474b.nhc
- %TEMP%\nsuc16f.tmp\nh_5b066b1843b9.nhc
- %TEMP%\nsuc16f.tmp\nh_114cbc113a9b.nhc
- %TEMP%\nsuc16f.tmp\nh_80e964c871c4.nhc
- %TEMP%\nsuc16f.tmp\nh_5ff8cf562dd9.nhc
- %TEMP%\nsuc16f.tmp\nh_70ffc2b875a5.nhc
- %TEMP%\nsuc16f.tmp\nh_db7e9d6410cf.nhc
- %TEMP%\nsuc16f.tmp\nh_15e595a9976a.nhc
- %TEMP%\nsuc16f.tmp\nh_76994d912e87.nhc
- %TEMP%\nsuc16f.tmp\nsexec.dll
- %TEMP%\nsuc16f.tmp\system.dll
Moves the following files
- from %APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_f6fc92d9618c to %APPDATA%\comain_ev2f79\ev2f79.exe
- from %APPDATA%\comain_ev2f79\ntrin.er.nhpart_9e6c3786fcd4 to %APPDATA%\comain_ev2f79\ntrin.er
- from %APPDATA%\comain_ev2f79\otrm.oi.nhpart_7e6fc832474b to %APPDATA%\comain_ev2f79\otrm.oi
- from %APPDATA%\comain_ev2f79\yinma.vc.nhpart_5b066b1843b9 to %APPDATA%\comain_ev2f79\yinma.vc
- from %APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_114cbc113a9b to %APPDATA%\comain_ev2f79\dxyvnb.ti
- from %APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_80e964c871c4 to %APPDATA%\comain_ev2c34\ev2c34.exe
- from %APPDATA%\comain_ev2c34\bnymir.ou.nhpart_5ff8cf562dd9 to %APPDATA%\comain_ev2c34\bnymir.ou
- from %APPDATA%\comain_ev2c34\bteuns.pt.nhpart_70ffc2b875a5 to %APPDATA%\comain_ev2c34\bteuns.pt
- from %APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_db7e9d6410cf to %APPDATA%\comain_ev2c34\cmrsk.ce
- from %APPDATA%\comain_ev2c34\fhkan.oi.nhpart_15e595a9976a to %APPDATA%\comain_ev2c34\fhkan.oi
- from %APPDATA%\comain_ev2c34\ap.asin.nhpart_76994d912e87 to %APPDATA%\comain_ev2c34\ap.asin
Network activity
Connects to
- '11#.#07.46.47':8853
- '11#.#07.46.47':8852
TCP
Other
- '11#.#07.46.47':8853
- '11#.#07.46.47':8852
Miscellaneous
Searches for the following windows
- ClassName: 'LogView_qqpcmgr' WindowName: ''
Creates and executes the following
- '%APPDATA%\comain_ev2f79\ev2f79.exe'
- '%APPDATA%\comain_ev2c34\ev2c34.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I /C:"360tray.exe" /C:"HipsTray.exe"
- '%WINDIR%\syswow64\cmd.exe' /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\"
- '%WINDIR%\syswow64\cmd.exe' /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\"
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\useraccountbroker.exe'
- '<SYSTEM32>\edpnotify.exe'
- '%WINDIR%\syswow64\cmd.exe' /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,<Drive name for removable media>:\"' (with hidden window)
