Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'ph_exec_Protected' = '%LOCALAPPDATA%\ph_exec_Protected.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ph_exec_Protected' = '%LOCALAPPDATA%\ph_exec_Protected.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\ph_exec_protected.exe
Malicious functions
Injects code into
the following user processes:
- ph_exec_protected.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions\]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\f66d3f0e\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\1094921950057763971308.tmp
- %TEMP%\1094859427140155102951.tmp
- %TEMP%\10948436847790999012725.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\1094921950057763971308.tmp-shm
- %TEMP%\10932184279648747295802.tmp
- %TEMP%\f66d3f0e\vcruntime140.dll
- %TEMP%\f66d3f0e\ucrtbase.dll
- %TEMP%\f66d3f0e\softokn3.dll
- %TEMP%\f66d3f0e\nssdbm3.dll
- %TEMP%\f66d3f0e\nss3.dll
- %TEMP%\f66d3f0e\msvcp140.dll
- %TEMP%\f66d3f0e\mozglue.dll
- %TEMP%\10931878196655294418684.tmp
- %TEMP%\ph_exec_ab6c.exe
- %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.id[ef757a47-2275].[checkcheck07@qq.com].adame
- %TEMP%\10949689174492781328284.tmp
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.id[ef757a47-2275].[checkcheck07@qq.com].adame
- %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.id[ef757a47-2275].[checkcheck07@qq.com].adame
- %ProgramFiles%\microsoft office\office14\accwiz\acwzlib.accde.id[ef757a47-2275].[checkcheck07@qq.com].adame
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.id[ef757a47-2275].[checkcheck07@qq.com].adame
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id[ef757a47-2275].[checkcheck07@qq.com].adame
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id[ef757a47-2275].[checkcheck07@qq.com].adame
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\ph_exec_protected.exe
- %TEMP%\f66d3f0e\freebl3.dll
- %LOCALAPPDATA%\ph_exec_protected.exe
- %TEMP%\ph_exec_protected.exe
- %TEMP%\10950151987704364463295.tmp-shm
- %TEMP%\10950151987704364463295.tmp
- %TEMP%\10950004668957784042731.tmp
- %TEMP%\10950006093892467029353.tmp
- %TEMP%\1094984410825016721748.tmp
- %TEMP%\1094968638558382453643.tmp
- %TEMP%\10949532903317773007989.tmp
- %TEMP%\10949535035592135357263.tmp
- %TEMP%\f66d3f0e\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\f66d3f0e\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-rtlsupport-l1-1-0.dll
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.id[ef757a47-2275].[checkcheck07@qq.com].adame
Deletes the following files
- %TEMP%\10931878196655294418684.tmp
- %TEMP%\f66d3f0e\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\f66d3f0e\ucrtbase.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\f66d3f0e\freebl3.dll
- %TEMP%\f66d3f0e\mozglue.dll
- %TEMP%\f66d3f0e\msvcp140.dll
- %TEMP%\f66d3f0e\nss3.dll
- %TEMP%\f66d3f0e\nssdbm3.dll
- %TEMP%\f66d3f0e\softokn3.dll
- %TEMP%\f66d3f0e\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\10950151987704364463295.tmp
- %TEMP%\10932184279648747295802.tmp
- %TEMP%\10948436847790999012725.tmp
- %TEMP%\1094859427140155102951.tmp
- %TEMP%\1094921950057763971308.tmp-shm
- %TEMP%\1094921950057763971308.tmp
- %TEMP%\10949532903317773007989.tmp
- %TEMP%\10949535035592135357263.tmp
- %TEMP%\10949689174492781328284.tmp
- %TEMP%\1094968638558382453643.tmp
- %TEMP%\1094984410825016721748.tmp
- %TEMP%\10950006093892467029353.tmp
- %TEMP%\10950004668957784042731.tmp
- %TEMP%\10950151987704364463295.tmp-shm
- %TEMP%\f66d3f0e\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\f66d3f0e\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\f66d3f0e\vcruntime140.dll
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://fr####countsfore.ug/ph_exec_Protected.exe
- http://fr####countsfore.ug/ph_exec_AB6C.exe
HTTP POST requests
- http://fr####countsfore.ug/index.php
UDP
- DNS ASK fr####countsfore.ug
Miscellaneous
Creates and executes the following
- '%TEMP%\ph_exec_protected.exe'
- '%TEMP%\ph_exec_ab6c.exe'
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "<File name>.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "<File name>.exe"
- '%WINDIR%\syswow64\timeout.exe' 3
