Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\desktop.it.lnk
- %HOMEPATH%\start menu\programs\startup\desktop.ini.lnk
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /im cmd.exe
- '<SYSTEM32>\taskkill.exe' /IM svchost.exe
- '<SYSTEM32>\taskkill.exe' /F /IM gcc-win32.exe
- '<SYSTEM32>\taskkill.exe' /IM odbcad32.exe
Modifies file system
Creates the following files
- %APPDATA%\system32\mmc.exe
- %APPDATA%\system32\exitg.vbs
- %APPDATA%\system32\startgc.cmd
- %APPDATA%\system32\gcc-win32.exe
- %APPDATA%\system32\updatessm.vbs
- %APPDATA%\system32\updatemssm.vbs
- %APPDATA%\system32\startupdate.cmd
- %APPDATA%\system32\startmupdate.cmd
- %APPDATA%\system32\config.json
- %TEMP%\is-udsgr.tmp\windows 10 activator ultimate 2019 1.1 setup.tmp
- %ProgramFiles%\%localappdata%\system32\startps.bat
- %ProgramFiles%\%localappdata%\system32\ps.ps1
- %ProgramFiles%\%localappdata%\system32\pcmd.vbs
- %ProgramFiles%\%localappdata%\system32\hostd.vbs
- %ProgramFiles%\%localappdata%\system32\svhost.bat
- %ProgramFiles%\%localappdata%\system32\hps.vbs
- %APPDATA%\system32\odbcad32.exe
- %ProgramFiles%\%localappdata%\system32\windows 10 activator ultimate 2019 1.1 setup.exe
- %APPDATA%\system32\svchost.exe
Network activity
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\system32\mmc.exe' -p123
- '<SYSTEM32>\wscript.exe' "%ProgramFiles%\%localappdata%\system32\hostd.vbs"
- '<SYSTEM32>\wscript.exe' "%ProgramFiles%\%localappdata%\system32\pcmd.vbs"
- '%ProgramFiles%\%localappdata%\system32\windows 10 activator ultimate 2019 1.1 setup.exe'
- '%APPDATA%\system32\odbcad32.exe'
- '%TEMP%\is-udsgr.tmp\windows 10 activator ultimate 2019 1.1 setup.tmp' /SL5="$201C4,5579476,57856,%ProgramFiles%\%localappdata%\system32\Windows 10 Activator Ultimate 2019 1.1 Setup.exe"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\system32\updatessm.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\system32\updatemssm.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\system32\exitg.vbs"
- '%APPDATA%\system32\gcc-win32.exe' -p123
- '%APPDATA%\system32\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c startps.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c startupdate.cmd' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c svhost.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c startmupdate.cmd' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c startgc.cmd' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c Taskkill /im cmd.exe
- '<SYSTEM32>\cmd.exe' /c startps.bat
- '<SYSTEM32>\wscript.exe' "\system32\hps.vbs" -ExecutionPolicy ByPass -File "\system32\ps.ps1"
- '<SYSTEM32>\cmd.exe' /c startupdate.cmd
- '<SYSTEM32>\cmd.exe' /c svhost.bat
- '<SYSTEM32>\cmd.exe' /c startmupdate.cmd
- '<SYSTEM32>\cmd.exe' /c startgc.cmd
