Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\SIVDriver] 'ImagePath' = '<DRIVERS>\SIVX64.sys'
Creates the following services
- 'SIVDriver' <DRIVERS>\SIVX64.sys
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop RpcSs
- '%WINDIR%\syswow64\net.exe' stop wmiApSrv
- '%WINDIR%\syswow64\net.exe' stop RpcLocator
- '%WINDIR%\syswow64\net.exe' stop DcomLaunch
Modifies file system
Creates the following files
- %TEMP%\nscad01.tmp
- %WINDIR%\logs\sysinfo\tools\usbdevs.txt
- %WINDIR%\logs\sysinfo\tools\wput.exe
- %WINDIR%\logs\sysinfo\tools\www.samlab.ws.url
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\actions.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\process.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\devices.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\crashes.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\!bsod!.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\execute.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\startup.htm
- %WINDIR%\logs\sysinfo\tools\pixidngxm.html
- %WINDIR%\logs\sysinfo\tools\installeddriverslist.exe
- %WINDIR%\logs\sysinfo\tools\logs\2021_03_23__01_33_20__pixidngxm_log.txt
- %WINDIR%\logs\sysinfo\tools\hwids.txt
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\drivers.htm
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\drivers.html
- <DRIVERS>\sivx64.sys
- %WINDIR%\logs\sysinfo\tools\siv_dbgout.log
- %WINDIR%\logs\sysinfo\tools\siv_pixidngxm.txt
- %WINDIR%\logs\sysinfo\logs\pixidngxm\system\setupapi.dev.log
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\hwids.txt
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\pixidngxm.html
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sysinfo\siv_pixidngxm.txt
- %WINDIR%\logs\sysinfo\logs\pixidngxm\sdi-logs\2021_03_23__01_33_26__pixidngxm_state.snp
- %WINDIR%\logs\sysinfo\tools\pcmdevs.txt
- %WINDIR%\logs\sysinfo\tools\pnpdevs.txt
- %WINDIR%\logs\sysinfo\tools\pcidevs.txt
- %WINDIR%\logs\sysinfo\tools\mondevs.txt
- %WINDIR%\logs\sysinfo\tools\hidec.exe
- %TEMP%\nscad02.tmp\modern-header.bmp
- %TEMP%\nscad02.tmp\nsprocess.dll
- %WINDIR%\logs\sysinfo\tools\7za.exe
- %WINDIR%\logs\sysinfo\tools\appcrashview.exe
- %WINDIR%\logs\sysinfo\tools\bluescreenview.exe
- %WINDIR%\logs\sysinfo\tools\boxcutter.exe
- %WINDIR%\logs\sysinfo\tools\cprocess.exe
- %WINDIR%\logs\sysinfo\tools\devmanview.exe
- %WINDIR%\logs\sysinfo\tools\driverview.exe
- %WINDIR%\logs\sysinfo\tools\driverview64.exe
- %WINDIR%\logs\sysinfo\tools\executedprogramslist.exe
- %WINDIR%\logs\sysinfo\tools\log.exe
- %WINDIR%\logs\sysinfo\tools\logs\2021_03_23__01_33_26__pixidngxm_state.snp
- %WINDIR%\logs\sysinfo\tools\hwids.cmd
- %WINDIR%\logs\sysinfo\tools\lastactivityview.exe
- %WINDIR%\logs\sysinfo\tools\sdi-drv.exe
- %WINDIR%\logs\sysinfo\tools\siv32x.exe
- %WINDIR%\logs\sysinfo\tools\siv64x.exe
- %WINDIR%\logs\sysinfo\tools\sivx32.sys
- %WINDIR%\logs\sysinfo\tools\sivx64.sys
- %WINDIR%\logs\sysinfo\tools\sysinf.bat
- %WINDIR%\logs\sysinfo\tools\whatinstartup.exe
- %WINDIR%\logs\sysinfo\tools\winaudit.exe
- %WINDIR%\logs\sysinfo\tools\devcon.exe
- %WINDIR%\logs\sysinfo\tools\fix_dll.cmd
- %TEMP%\nscad02.tmp\system.dll
- %WINDIR%\logs\sysinfo\tools\installeddriverslist64.exe
- %WINDIR%\logs\sysinfo\logs\pixidngxm\system\dxdiag.txt
Network activity
Connects to
- 'microsoft.com':80
- 'ap#.##infodb.com':80
- 'public-trust.com':80
UDP
- DNS ASK microsoft.com
- DNS ASK ap#.##infodb.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK public-trust.com
Miscellaneous
Searches for the following windows
- ClassName: 'MPWClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\logs\sysinfo\tools\lastactivityview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Actions.htm
- '%WINDIR%\logs\sysinfo\tools\installeddriverslist64.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Drivers.html
- '%WINDIR%\logs\sysinfo\tools\driverview64.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Drivers.htm
- '%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' status *
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find acpi*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find usb*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find hid*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' hwids *CC_01* *Raid*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find hdaudio*
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find =net
- '%WINDIR%\logs\sysinfo\tools\siv64x.exe' -SAVE[devices][device-ids][dimms][driver-vsn][environment][hw-status][interfaces][my-ip-address][overview][pnp-dev][processes][startup][software][system][uaa-dev]
- '%WINDIR%\logs\sysinfo\tools\devcon.exe' find pci*
- '%WINDIR%\logs\sysinfo\tools\hidec.exe' /W %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
- '%WINDIR%\logs\sysinfo\tools\winaudit.exe' /r=gz /o=HTML
- '%WINDIR%\logs\sysinfo\tools\whatinstartup.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Startup.htm
- '%WINDIR%\logs\sysinfo\tools\executedprogramslist.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Execute.htm
- '%WINDIR%\logs\sysinfo\tools\bluescreenview.exe' /scomma %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\!BSOD!.txt
- '%WINDIR%\logs\sysinfo\tools\bluescreenview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\!BSOD!.htm
- '%WINDIR%\logs\sysinfo\tools\appcrashview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Crashes.htm
- '%WINDIR%\logs\sysinfo\tools\devmanview.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Devices.htm
- '%WINDIR%\logs\sysinfo\tools\sdi-drv.exe' -nogui -autoclose
- '%WINDIR%\logs\sysinfo\tools\cprocess.exe' /shtml %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\SysInfo\Process.htm
- '%WINDIR%\logs\sysinfo\tools\log.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd' (with hidden window)
Executes the following
- '<SYSTEM32>\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\System\DxDiag.txt
- '<SYSTEM32>\locator.exe'
- '%WINDIR%\syswow64\net1.exe' start RpcLocator
- '%WINDIR%\syswow64\net.exe' start RpcLocator
- '%WINDIR%\syswow64\net1.exe' start wmiApSrv
- '%WINDIR%\syswow64\net.exe' start wmiApSrv
- '%WINDIR%\syswow64\net1.exe' start RpcSs
- '%WINDIR%\syswow64\net.exe' start RpcSs
- '%WINDIR%\syswow64\sc.exe' config DcomLaunch start=auto
- '%WINDIR%\syswow64\sc.exe' config RpcLocator start=auto
- '%WINDIR%\syswow64\sc.exe' config wmiApSrv start=auto
- '%WINDIR%\syswow64\sc.exe' config RpcSs start=auto
- '%WINDIR%\syswow64\net1.exe' stop DcomLaunch
- '%WINDIR%\syswow64\net1.exe' stop RpcLocator
- '%WINDIR%\syswow64\net1.exe' stop wmiApSrv
- '%WINDIR%\syswow64\net1.exe' stop RpcSs
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.css" /v "Content Type" /t reg_sz /d text/css /f
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\fix_dll.cmd
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Logs\SysInfo\Tools\HWIDs.cmd
- '%WINDIR%\syswow64\dxdiag.exe' /t %WINDIR%\Logs\SysInfo\LOGs\pixidngxm\System\DxDiag.txt
- '%WINDIR%\syswow64\net.exe' start DcomLaunch
- '%WINDIR%\syswow64\net1.exe' start DcomLaunch
