Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%WINDIR%\PLA\Reports\en-US\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%WINDIR%\PLA\Reports\en-US\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%WINDIR%\PLA\Reports\en-US\iexplore.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\Users\Default User\WUDFHost.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\Users\Default User\WUDFHost.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%WINDIR%\PLA\Reports\en-US\iexplore.exe", "C:\Users\Default User\WUDFHost.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<Current directory>\csrss.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<Current directory>\csrss.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%WINDIR%\PLA\Reports\en-US\iexplore.exe", "C:\Users\Default User\WUDFHost.exe", "<Current directory>\csrss...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\spoolsv.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\spoolsv.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\kms\csrss.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\kms\csrss.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\<File name>k
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- <Current directory>\786df0c088c773
- %HOMEPATH%\desktop\kudukbam.log
- %HOMEPATH%\desktop\jetzgmpp.log
- %HOMEPATH%\desktop\hjyednpt.log
- %HOMEPATH%\desktop\ogmegcji.log
- %HOMEPATH%\desktop\nqbjcnzl.log
- %HOMEPATH%\desktop\uzodiiow.log
- %TEMP%\hxpsyvyzwe
- %TEMP%\jfwcjnok7w
- %TEMP%\vhhwhsyrua
- %TEMP%\lqrhyuk6j7
- %TEMP%\lyexme8bu8
- %TEMP%\evkkpddbve
- %TEMP%\dra9l7ctjc
- %TEMP%\uxhw60qg24
- %TEMP%\1jlopc0irs
- %TEMP%\gtxg5w4k9s
- %TEMP%\atrtu5bvjp
- %TEMP%\n1xsx3fwti
- %TEMP%\g3c15bjb0j
- %TEMP%\5fhj4h2s3u
- %TEMP%\be9bepweib
- %TEMP%\lgrzxtva4z
- %TEMP%\ypbx2jhb4k
- %HOMEPATH%\desktop\dlqaegkb.log
- %TEMP%\wqof2zcxyq
- %HOMEPATH%\desktop\ebavhvvx.log
- %HOMEPATH%\desktop\hbgrldku.log
- C:\kms\csrss.exe
- C:\kms\886983d96e3d3e
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\spoolsv.exe
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\f3b6ecef712a24
- <Current directory>\csrss.exe
- <Current directory>\886983d96e3d3e
- C:\users\default user\wudfhost.exe
- C:\users\default user\480b7989c529f6
- %WINDIR%\pla\reports\en-us\iexplore.exe
- %WINDIR%\pla\reports\en-us\9db6e019d4f04e
- %TEMP%\xqp13bl4.0.cs
- %TEMP%\xqp13bl4.cmdline
- %TEMP%\xqp13bl4.out
- %TEMP%\toqsvhajvg
- %TEMP%\b5r2uroknl.bat
- nul
- %HOMEPATH%\desktop\hvtcidqn.log
- %HOMEPATH%\desktop\bjnhpsly.log
- %HOMEPATH%\desktop\kcwcvfgj.log
- %HOMEPATH%\desktop\bzommmqc.log
- %HOMEPATH%\desktop\ihbhshgn.log
- %HOMEPATH%\desktop\hrrmosvq.log
- %HOMEPATH%\desktop\oaegunkb.log
- %HOMEPATH%\desktop\erkqlkft.log
- %TEMP%\yxac4kybkk
Deletes the following files
- %TEMP%\xqp13bl4.out
- %TEMP%\xqp13bl4.0.cs
- %TEMP%\xqp13bl4.cmdline
- %TEMP%\toqsvhajvg
- %TEMP%\hxpsyvyzwe
- %TEMP%\be9bepweib
- %TEMP%\lgrzxtva4z
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
Connects to
- '48#####m.nyashtech.top':80
TCP
HTTP POST requests
- http://48#####m.nyashtech.top/eternalSqltestDleLocal.php
UDP
- DNS ASK 48#####m.nyashtech.top
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\kms\csrss.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\b5R2uRoKNl.bat"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xqp13bl4.cmdline"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'%WINDIR%\PLA\Reports\en-US\iexplore.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\b5R2uRoKNl.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>k" /sc MINUTE /mo 14 /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>k" /sc MINUTE /mo 12 /tr "'<Full path to file>'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\kms\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\kms\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\kms\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'<Current directory>\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\WUDFHost.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\xqp13bl4.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'%WINDIR%\PLA\Reports\en-US\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%WINDIR%\PLA\Reports\en-US\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
