Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HDMIёЯЗеПФКѕЗэ¶Ї(ЗРОр№Ш±Х)' = 'C:\AMDFile\HDMIdrivers.exe'
Malicious functions:
Creates and executes the following:
- 'C:\AMDFile\HDMIdrivers.exe'
- '%TEMP%\Temp_3411992119.EXE'
Executes the following:
- '<SYSTEM32>\mode.com' con: cols=40 lines=10
- '<SYSTEM32>\cmd.exe' /c ""C:\AMDFile\AMDFile.bat" "
Modifies file system:
Creates the following files:
- C:\AMDFile\AMDFile.bat
- C:\AMDFile\HDMIdrivers.cfg
- %TEMP%\Temp_3411992119.EXE
- C:\AMDFile\HDMIdrivers.exe
Sets the 'hidden' attribute to the following files:
- C:\AMDFile\HDMIdrivers.cfg
- C:\AMDFile\HDMIdrivers.exe
- %TEMP%\Temp_3411992119.EXE
Deletes the following files:
- <SYSTEM32>\CatRoot2\edb0000D.log
- <SYSTEM32>\CatRoot2\edb0000E.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\res2.log
- <SYSTEM32>\CatRoot2\edb.log
- <SYSTEM32>\CatRoot2\edb0000F.log
- <SYSTEM32>\CatRoot2\edb00012.log
- <SYSTEM32>\CatRoot2\edb00013.log
- <SYSTEM32>\CatRoot2\edb00010.log
- <SYSTEM32>\CatRoot2\edb00011.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\res1.log
- %WINDIR%\pchealth\helpctr\Logs\hcupdate.log
- %WINDIR%\repair\setup.log
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
- %WINDIR%\security\logs\backup.log
- %WINDIR%\SoftwareDistribution\ReportingEvents.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\edb.log
- %WINDIR%\security\logs\SceRoot.log
- %WINDIR%\security\logs\scesetup.log
- <SYSTEM32>\CatRoot2\edb00014.log
- <SYSTEM32>\wbem\Logs\wbemess.log
- <SYSTEM32>\wbem\Logs\wbemprox.log
- <SYSTEM32>\wbem\Logs\setup.log
- <SYSTEM32>\wbem\Logs\wbemcore.log
- <SYSTEM32>\wbem\Logs\wmiadap.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\edb.chk
- <SYSTEM32>\CatRoot2\edb.chk
- <SYSTEM32>\wbem\Logs\wmiprov.log
- <ANALYSETOOLS_DIR>\DumpNet\CmdDotNetDumper.log
- <SYSTEM32>\wbem\Logs\replog.log
- <SYSTEM32>\CatRoot2\edb00017.log
- <SYSTEM32>\CatRoot2\res1.log
- <SYSTEM32>\CatRoot2\edb00015.log
- <SYSTEM32>\CatRoot2\edb00016.log
- <SYSTEM32>\CatRoot2\res2.log
- <SYSTEM32>\wbem\Logs\FrameWork.log
- <SYSTEM32>\wbem\Logs\mofcomp.log
- <SYSTEM32>\MsDtc\MSDTC.LOG
- <SYSTEM32>\MsDtc\Trace\dtctrace.log
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
- %WINDIR%\imsins.log
- %WINDIR%\KB942288-v3.log
- %WINDIR%\FaxSetup.log
- %WINDIR%\iis6.log
- %WINDIR%\MedCtrOC.log
- %WINDIR%\netfxocm.log
- %WINDIR%\ntdtcsetup.log
- %WINDIR%\msgsocm.log
- %WINDIR%\msmqinst.log
- %WINDIR%\DtcInstall.log
- %WINDIR%\SET4.tmp
- %WINDIR%\SET8.tmp
- %TEMP%\Temp_3411992119.EXE
- %WINDIR%\SET3.tmp
- <SYSTEM32>\CONFIG.TMP
- %WINDIR%\COM+.log
- %WINDIR%\comsetup.log
- %WINDIR%\0.log
- %WINDIR%\cmsetacl.log
- %WINDIR%\ocgen.log
- %WINDIR%\wiaservc.log
- %WINDIR%\WindowsUpdate.log
- %WINDIR%\updspapi.log
- %WINDIR%\wiadebug.log
- %WINDIR%\wmsetup.log
- %WINDIR%\Debug\UserMode\userenv.log
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.log
- %WINDIR%\Debug\blastcln.log
- %WINDIR%\Debug\NetSetup.LOG
- %WINDIR%\tsoc.log
- %WINDIR%\sessmgr.setup.log
- %WINDIR%\setupact.log
- %WINDIR%\ocmsn.log
- %WINDIR%\regopt.log
- %WINDIR%\setupapi.log
- %WINDIR%\Sti_Trace.log
- %WINDIR%\tabletoc.log
- %WINDIR%\setuperr.log
- %WINDIR%\spupdsvc.log
Network activity:
Connects to:
- 'my####.wcinc.win':80
TCP:
HTTP GET requests:
- http://my####.wcinc.win/mydata/pckb.html
UDP:
- DNS ASK my####.wcinc.win
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
