Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'liberated' = '"%ProgramFiles%\Purifies\motels.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'gnarled' = '"%ProgramFiles%\Purifies\motels.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'liberatedgnarled' = '"%ProgramFiles%\gainsaying\rattle.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'gnarledliberated' = '"%ProgramFiles%\gainsaying\rattle.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'liberatedliberated' = '"%ProgramFiles%\Clerkships\motels.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'gnarledgnarled' = '"%ProgramFiles%\Clerkships\motels.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'moslems' = '"%ProgramFiles%\Purifies\motels.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'miserly' = '"%ProgramFiles%\Purifies\motels.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'moslemsmiserly' = '"%ProgramFiles%\gainsaying\rattle.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'miserlymoslems' = '"%ProgramFiles%\gainsaying\rattle.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'moslemsmoslems' = '"%ProgramFiles%\Clerkships\motels.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'miserlymiserly' = '"%ProgramFiles%\Clerkships\motels.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'shambles' = '"%ProgramFiles%\emeraude\shambles.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'address' = '"%ProgramFiles%\Purifies\motels.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\hoven.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\hovenhoven.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im chrome.exe
Modifies file system:
Creates the following files:
- %TEMP%\nsm2.tmp\28443.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\aYtc2LnSKy0LnSKy1LnSKy80WdsLZe10aYtc4LnSKy[1].html
- %TEMP%\nseD.tmp\ShellLink.dll
- %TEMP%\nslA.tmp\nsB.tmp
- %TEMP%\nslA.tmp\nsExec.dll
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\2-aYtc2LnSKy0LnSKy1LnSKy80WdsLZe10aYtc4LnSKy[1].html
- %WINDIR%\heaton.exe
- %ProgramFiles%\emeraude\shambles.exe
- %ProgramFiles%\carew\carew.exe
- %ProgramFiles%\Clerkships\rattle.exe
- %ProgramFiles%\Clerkships\motels.exe
- %TEMP%\nsf5.tmp\SimpleFC.dll
- <LS_APPDATA>\rattle.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\aYtc2LnSKy0LnSKy1LnSKy80WdsLZe10aYtc4LnSKy[1].html
- <LS_APPDATA>\motels.exe
- %ProgramFiles%\gainsaying\rattle.dll
- %ProgramFiles%\gainsaying\gainsaying.exe
- %ProgramFiles%\Purifies\motels.exe
- %ProgramFiles%\Purifies\motels.dll
- %ProgramFiles%\Purifies\Purifies.exe
- %TEMP%\nsm2.tmp\119358.exe
- %TEMP%\nsm2.tmp\Microsoft.Win32.TaskScheduler.dll
- %TEMP%\nsm2.tmp\NMisp.exe
- %TEMP%\nsm2.tmp\126094.exe
- %TEMP%\nsm2.tmp\106756.exe
- %TEMP%\nsm2.tmp\62653.exe
- %TEMP%\nsm2.tmp\45373.exe
- %ProgramFiles%\gainsaying\rattle.exe
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
Deletes the following files:
- %TEMP%\nsf5.tmp\SimpleFC.dll
- %TEMP%\nsu7.tmp\AccessControl.dll
- %TEMP%\nseD.tmp\ShellLink.dll
Network activity:
Connects to:
- 'localhost':1038
- 'localhost':1039
- 'localhost':1040
- 'ma####fulcrum.pw':80
- 'localhost':1049
TCP:
HTTP GET requests:
- http://www.ma####fulcrum.pw/2-aYtc2LnSKy0LnSKy1LnSKy80WdsLZe10aYtc4LnSKy.html?ro############################################# via ma####fulcrum.pw
- http://www.ma####fulcrum.pw/aYtc2LnSKy0LnSKy1LnSKy80WdsLZe10aYtc4LnSKy.html?pi############################################ via ma####fulcrum.pw
UDP:
- DNS ASK www.ma####fulcrum.pw
- DNS ASK ww##.##lianfulcrum.pw
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsm2.tmp\NMisp.exe' "%ProgramFiles%\Purifies\motels.exe" "27764087"
- '%TEMP%\nsm2.tmp\62653.exe'
- '%ProgramFiles%\emeraude\shambles.exe'
- '%TEMP%\nsm2.tmp\119358.exe'
- '%TEMP%\nsm2.tmp\NMisp.exe' "%ProgramFiles%\carew\carew.exe" "k24947659"
- '%TEMP%\nsm2.tmp\NMisp.exe' "%ProgramFiles%\Clerkships\rattle.exe" "2494765924947659"
- '%TEMP%\nsm2.tmp\NMisp.exe' "%ProgramFiles%\Clerkships\motels.exe" "24947659"
- '%TEMP%\nslA.tmp\nsB.tmp' taskkill /im chrome.exe
- '%ProgramFiles%\Clerkships\rattle.exe'
- '%TEMP%\nsm2.tmp\NMisp.exe' "<LS_APPDATA>\rattle.exe" "1896069218960692"
- '%TEMP%\nsm2.tmp\NMisp.exe' "<LS_APPDATA>\motels.exe" "18960692"
- '%TEMP%\nsm2.tmp\45373.exe'
- '%ProgramFiles%\Purifies\motels.exe'
- '%TEMP%\nsm2.tmp\126094.exe'
- '%TEMP%\nsm2.tmp\NMisp.exe' "%ProgramFiles%\gainsaying\rattle.exe" "2776408727764087"
- '%ProgramFiles%\Clerkships\motels.exe'
- '%TEMP%\nsm2.tmp\106756.exe'
