Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio' = '%PROGRAMDATA%\RealtekHD\taskhostw.exe'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %TEMP%\auta1b0.tmp
- %PROGRAMDATA%\windowstask\winlogon.exe
- %PROGRAMDATA%\windowstask\5
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\pgv7rqbt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xzfjygyw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qax3e81i\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7d7shory\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %PROGRAMDATA%\windowstask\microsofthost.exe
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\windowstask\winlogon.exe
- %PROGRAMDATA%\windowstask\5
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\pgv7rqbt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xzfjygyw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qax3e81i\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7d7shory\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %PROGRAMDATA%\windowstask\microsofthost.exe
Deletes the following files
- %TEMP%\auta1b0.tmp
- %WINDIR%\tasks\adobe flash player updater.job
- <SYSTEM32>\tasks\adobe flash player updater
- <SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask
- <SYSTEM32>\tasks\adobe acrobat update task
Substitutes the following files
- %PROGRAMDATA%\ntuser.pol
- %HOMEPATH%\ntuser.pol
Network activity
TCP
HTTP GET requests
- http://pu####042020.com/randomnan/STATUS.html
- http://pu####042020.com/randomnan/loaderTOP.html
- http://pu####042020.com/randomnan/Login.html
- http://pu####042020.com/randomnan/Password.html
- http://pu####042020.com/randomnan/Server.html
- http://pu####042020.com/randomnan/configCPUX.html
UDP
- DNS ASK pu####042020.com
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\windowstask\winlogon.exe'
- '%PROGRAMDATA%\windowstask\microsofthost.exe' -o stratum+tcp://45.145.0.31:6363 -u Toprig --donate-level=1 -k -t1
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /query /fo list' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c gpupdate /force' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Acrobat Update Task" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Flash Player Updater" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F' (with hidden window)
- '%PROGRAMDATA%\windowstask\microsofthost.exe' -o stratum+tcp://45.145.0.31:6363 -u Toprig --donate-level=1 -k -t1' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /query /fo list
- '%WINDIR%\syswow64\schtasks.exe' /query /fo list
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns
- '<SYSTEM32>\cmd.exe' /c gpupdate /force
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Acrobat Update Task" /F
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Flash Player Updater" /F
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F
- '<SYSTEM32>\gpupdate.exe' /force
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Adobe Flash Player Updater" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Adobe Acrobat Update Task" /F
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\raserver.exe' /offerraupdate
