Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd3dx32' = 'C:\systemWOW32\System.lnk'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adobe QuikInstall' = '%APPDATA%\Adobe\Adobe QuikInstall.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\bkphst32.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\winlog.lnk
Modifies file system
Creates the following files
- C:\systemwow32\uus7w2ztvjwa7lmz5vlp.exe
- %TEMP%\dclib\antivm.dclib
- %APPDATA%\notepad\system.vbe
- %APPDATA%\adobe\adobe quikinstall.exe
- %APPDATA%\sun\watchdog.data
- %APPDATA%\vortex\watchdog.data
- %APPDATA%\obsidium\watchdog.data
- %APPDATA%\sun\yourphone.exe
- %APPDATA%\vortex\securityhealthservice.exe
- %APPDATA%\obsidium\runtime broker.exe
- %APPDATA%\notepad\media.zip
- C:\systemwow32\winlog.lnk
- %HOMEPATH%\pictures\vmcheck32.dll
- %HOMEPATH%\pictures\bkphst32.lnk
- %HOMEPATH%\pictures\bkphst32.exe
- %TEMP%\dclib\antiwindowsdefender.dclib
- C:\systemwow32\system.lnk
- C:\systemwow32\dllhost.exe
- C:\systemwow32\vmcheck32.dll
- C:\systemwow32\oud8yqxqnsdtifr0i0uyg25qpk1nez.bat
- C:\systemwow32\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- C:\systemwow32\dclib\antiwindowsdefender.dclib
- C:\systemwow32\dclib\antivm.dclib
- C:\systemwow32\watchdog.data
- C:\systemwow32\starter.exe
- C:\systemwow32\dogs\yourphone.exe
- C:\systemwow32\dogs\securityhealthservice.exe
- C:\systemwow32\dogs\runtime broker.exe
- C:\systemwow32\dogs\adobe quikinstall.exe
- C:\systemwow32\zmxiiuobrtl6e0ajpglbkwa4dnti1s.bat
- C:\systemwow32\75kn8cpwaebfvhwppvusbblcopztcx.vbs
- C:\systemwow32\system.vbe
- %TEMP%\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
Network activity
UDP
- DNS ASK vk##oup.tk
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\systemWOW32\75kn8cpwaEbFvHWppvuSbbLCOpZTCX.vbs"
- 'C:\systemwow32\uus7w2ztvjwa7lmz5vlp.exe' -pdf22bbede9b148db42e1b34410928216a4ddf42a
- '%WINDIR%\syswow64\wscript.exe' "C:\systemWOW32\System.vbe"
- 'C:\systemwow32\starter.exe'
- 'C:\systemwow32\dllhost.exe'
- '%APPDATA%\adobe\adobe quikinstall.exe'
- '%APPDATA%\vortex\securityhealthservice.exe'
- '%APPDATA%\sun\yourphone.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\ZMxiiUobrTl6E0AJPGLBKWa4Dnti1s.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\oUd8yqxqnsDTIFr0i0uYg25qpK1nez.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Obsidium\Runtime Broker.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Vortex\SecurityHealthService.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Sun\YourPhone.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\ZMxiiUobrTl6E0AJPGLBKWa4Dnti1s.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\systemWOW32\oUd8yqxqnsDTIFr0i0uYg25qpK1nez.bat" "
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Obsidium\Runtime Broker.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Vortex\SecurityHealthService.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Sun\YourPhone.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
