Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'C:\Users\$77-771ca14c28d5467c9622cc6fe0782dd2-x64.dll'
Creates or modifies the following files
- <SYSTEM32>\tasks\task1
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\config.txt
- %TEMP%\rarsfx0\1054.mst
- %TEMP%\rarsfx0\applications\info\1054.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1054.mst
- %TEMP%\rarsfx0\applications\core\1054.mst
- %TEMP%\rarsfx0\1053.mst
- %TEMP%\rarsfx0\applications\info\1053.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1053.mst
- %TEMP%\rarsfx0\applications\core\1053.mst
- %TEMP%\rarsfx0\1049.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1049.mst
- %TEMP%\rarsfx0\applications\core\1049.mst
- %TEMP%\rarsfx0\applications\info\1049.mst
- %TEMP%\rarsfx0\1046.mst
- %TEMP%\rarsfx0\applications\info\1042.mst
- %TEMP%\rarsfx0\applications\info\1046.mst
- %TEMP%\rarsfx0\applications\core\1046.mst
- %TEMP%\rarsfx0\1045.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1045.mst
- %TEMP%\rarsfx0\applications\core\1045.mst
- %TEMP%\rarsfx0\applications\info\1045.mst
- %TEMP%\rarsfx0\1044.mst
- %TEMP%\rarsfx0\applications\info\1044.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1044.mst
- %TEMP%\rarsfx0\applications\core\1044.mst
- %TEMP%\rarsfx0\1043.mst
- %TEMP%\rarsfx0\applications\info\1043.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1043.mst
- %TEMP%\rarsfx0\applications\core\1043.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1046.mst
- %TEMP%\rarsfx0\1042.mst
- %TEMP%\rarsfx0\applications\core\1055.mst
- %TEMP%\rarsfx0\applications\prerequisites\nvrtc64.vbs
- C:\users\public\$77p\log.log
- C:\users\public\$77p\config.txt
- C:\users\public\$77p\command.vbs
- C:\users\public\$77p\command.bat
- C:\users\public\$77p\autoupdate.vbs
- C:\users\public\$77p\$77p.exe
- C:\users\public\$77p\$77command.exe
- C:\users\$77-771ca14c28d5467c9622cc6fe0782dd2-x64.dll
- %TEMP%\nsv3914.tmp\betternetforwindows.msi
- %TEMP%\nsv3914.tmp\system.dll
- %TEMP%\32f9.tmp\32fa.tmp\32fb.bat
- %TEMP%\rarsfx0\applications\info\data1.cab
- %TEMP%\rarsfx0\applications\prerequisites\task.vbs
- %TEMP%\rarsfx0\applications\info\1055.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1055.mst
- %TEMP%\rarsfx0\applications\prerequisites\import.vbs
- %TEMP%\rarsfx0\applications\prerequisites\dll.vbs
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\command.vbs
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\autoupdate.vbs
- %TEMP%\rarsfx0\applications\prerequisites\backup.reg
- %TEMP%\rarsfx0\2070.mst
- %TEMP%\rarsfx0\applications\core\2070.mst
- %TEMP%\rarsfx0\applications\info\2070.mst
- %TEMP%\rarsfx0\2052.mst
- %TEMP%\rarsfx0\applications\info\2052.mst
- %TEMP%\rarsfx0\applications\coverdesigner\2052.mst
- %TEMP%\rarsfx0\applications\core\2052.mst
- %TEMP%\rarsfx0\1055.mst
- %TEMP%\rarsfx0\applications\prerequisites\run.vbs
- %TEMP%\rarsfx0\applications\coverdesigner\1042.mst
- %TEMP%\rarsfx0\applications\core\1042.mst
- %TEMP%\rarsfx0\1041.mst
- %TEMP%\rarsfx0\applications\core\1031.mst
- %TEMP%\rarsfx0\1030.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1030.mst
- %TEMP%\rarsfx0\applications\core\1030.mst
- %TEMP%\rarsfx0\applications\info\1030.mst
- %TEMP%\rarsfx0\1029.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1029.mst
- %TEMP%\rarsfx0\applications\core\1029.mst
- %TEMP%\rarsfx0\applications\info\1029.mst
- %TEMP%\rarsfx0\1028.mst
- %TEMP%\rarsfx0\applications\info\1028.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1028.mst
- %TEMP%\rarsfx0\applications\info\1031.mst
- %TEMP%\rarsfx0\applications\core\1028.mst
- %TEMP%\rarsfx0\applications\prerequisites\f1\$77-771ca14c28d5467c9622cc6fe0782dd2-x64.dll
- %TEMP%\rarsfx0\setup.exe
- %TEMP%\rarsfx0\applications\core\link.exe
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\$77p.exe
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\$77command.exe
- %TEMP%\rarsfx0\applications\prerequisites\task.bat
- %TEMP%\rarsfx0\applications\prerequisites\run.bat
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\run.bat
- %TEMP%\rarsfx0\applications\prerequisites\nvrtc64.bat
- %TEMP%\rarsfx0\applications\prerequisites\import.bat
- %TEMP%\rarsfx0\applications\prerequisites\dll.bat
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\command.bat
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\log.log
- %TEMP%\rarsfx0\applications\prerequisites\kernel\mon\$77p\opencl.dll
- %TEMP%\rarsfx0\1031.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1031.mst
- %TEMP%\rarsfx0\applications\info\1032.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1041.mst
- %TEMP%\rarsfx0\applications\core\1036.mst
- %TEMP%\rarsfx0\applications\core\1041.mst
- %TEMP%\rarsfx0\applications\info\1041.mst
- %TEMP%\rarsfx0\1040.mst
- %TEMP%\rarsfx0\applications\info\1040.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1040.mst
- %TEMP%\rarsfx0\applications\core\1040.mst
- %TEMP%\rarsfx0\1038.mst
- %TEMP%\rarsfx0\applications\info\1038.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1038.mst
- %TEMP%\rarsfx0\applications\core\1038.mst
- %TEMP%\rarsfx0\1036.mst
- %TEMP%\rarsfx0\applications\info\1036.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1036.mst
- %TEMP%\rarsfx0\1035.mst
- %TEMP%\rarsfx0\applications\core\1032.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1035.mst
- %TEMP%\rarsfx0\applications\core\1035.mst
- %TEMP%\rarsfx0\applications\info\1035.mst
- %TEMP%\rarsfx0\1034.mst
- %TEMP%\rarsfx0\applications\info\1034.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1034.mst
- %TEMP%\rarsfx0\applications\core\1034.mst
- %TEMP%\rarsfx0\applications\info\1033.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1033.mst
- %TEMP%\rarsfx0\applications\core\1033.mst
- %TEMP%\rarsfx0\1033.mst
- %TEMP%\rarsfx0\1032.mst
- %TEMP%\rarsfx0\applications\coverdesigner\1032.mst
- C:\users\public\$77p\opencl.dll
- C:\users\public\$77p\run.bat
Deletes the following files
- %TEMP%\32f9.tmp\32fa.tmp\32fb.bat
- %TEMP%\rarsfx0\2052.mst
- %TEMP%\rarsfx0\1055.mst
- %TEMP%\rarsfx0\1054.mst
- %TEMP%\rarsfx0\1053.mst
- %TEMP%\rarsfx0\1049.mst
- %TEMP%\rarsfx0\1046.mst
- %TEMP%\rarsfx0\1045.mst
- %TEMP%\rarsfx0\1044.mst
- %TEMP%\rarsfx0\1043.mst
- %TEMP%\rarsfx0\1042.mst
- %TEMP%\rarsfx0\2070.mst
- %TEMP%\rarsfx0\1041.mst
- %TEMP%\rarsfx0\1038.mst
- %TEMP%\rarsfx0\1036.mst
- %TEMP%\rarsfx0\1035.mst
- %TEMP%\rarsfx0\1034.mst
- %TEMP%\rarsfx0\1033.mst
- %TEMP%\rarsfx0\1032.mst
- %TEMP%\rarsfx0\1031.mst
- %TEMP%\rarsfx0\1030.mst
- %TEMP%\rarsfx0\1029.mst
- %TEMP%\rarsfx0\1028.mst
- %TEMP%\rarsfx0\1040.mst
- %TEMP%\rarsfx0\setup.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\setup.exe'
- '%TEMP%\rarsfx0\applications\core\link.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\applications\prerequisites\nvrtc64.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\applications\prerequisites\DLL.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\applications\prerequisites\import.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\applications\prerequisites\task.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\DLL.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\nvrtc64.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\import.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\task.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\32F9.tmp\32FA.tmp\32FB.bat %TEMP%\RarSFX0\setup.exe"
- '<SYSTEM32>\cmd.exe' /K run.bat
- '%WINDIR%\syswow64\msiexec.exe' /I "%TEMP%\nsv3914.tmp\BetternetForWindows.msi"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\DLL.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\nvrtc64.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\import.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\applications\prerequisites\task.bat" "
- '<SYSTEM32>\xcopy.exe' "%TEMP%\RarSFX0\applications\prerequisites\\f1" "C:\Users\" /i /e /Y
- '<SYSTEM32>\xcopy.exe' /s /i "%TEMP%\RarSFX0\applications\prerequisites\\Kernel\mon" "C:\Users\Public" /Y
- '<SYSTEM32>\reg.exe' import "%TEMP%\RarSFX0\applications\prerequisites\\backup.reg"
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN Task1 /TR C:\Users\Public\$77p\command.bat
