Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\z-6-3-98-1250991851-1020904103-1123752573-6289\{hmp2d5dz-8mqk-86c1-rqg8-coe1h8ckf4ff}
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\lisp_success.doc
Modifies file system
Creates the following files
- %PROGRAMDATA%\meth.exe
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\config.vdf
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\инструкция по установке.txt
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\dialogconfig.vdf
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c\map0
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\инструкция по установке.txt
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c1
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %TEMP%\_mei7242\select.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5y20irbf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yav3it2i\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yslfomz5\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\information.txt
- %TEMP%\aut378c.tmp
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe.9
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe
- %APPDATA%\amd64_wsynth3dvsp.inf\enu_684687fe972656442535.7z
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\applicantform_en.doc
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\lisp_success.doc
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\screen.jpg
- %TEMP%\~bkzpayk.tmp
- %TEMP%\aute64c.tmp
- %TEMP%\_mei7242\123.exe.manifest
- %TEMP%\_mei7242\vcruntime140.dll
- %TEMP%\_mei7242\_bz2.pyd
- %TEMP%\_mei7242\_ctypes.pyd
- %TEMP%\_mei7242\_hashlib.pyd
- %TEMP%\_mei7242\_lzma.pyd
- %TEMP%\_mei7242\_socket.pyd
- %TEMP%\_mei7242\_sqlite3.pyd
- %TEMP%\_mei7242\_ssl.pyd
- %TEMP%\_mei7242\pyexpat.pyd
- %APPDATA%\amd64_wsynth3dvsp.inf\shortinformation.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\v15lm85b\desktop.ini
- %TEMP%\_mei7242\python36.dll
- %TEMP%\_mei7242\unicodedata.pyd
- %TEMP%\_mei7242\base_library.zip
- %TEMP%\_mei7242\certifi\cacert.pem
- %TEMP%\token\firefox\webappsstore.sqlite
- %TEMP%\token\firefox\webappsstore.sqlite-shm
- %TEMP%\ca2eadcd-e183-4f76-bc83-a2095416449d.log
- %APPDATA%\amd64_wsynth3dvsp.inf\enu_684687fe972656442535
- %TEMP%\aute4b5.tmp
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll.9
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll
- %PROGRAMDATA%\best.exe
- %TEMP%\_mei7242\sqlite3.dll
- %APPDATA%\amd64_wsynth3dvsp.inf\e
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\meth.exe
- %PROGRAMDATA%\best.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\v15lm85b\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5y20irbf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yav3it2i\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yslfomz5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\token\firefox\webappsstore.sqlite-shm
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll
- %TEMP%\aut378c.tmp
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe.9
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe
- %APPDATA%\amd64_wsynth3dvsp.inf\e
- %TEMP%\aute64c.tmp
- %TEMP%\~bkzpayk.tmp
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\information.txt
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\lisp_success.doc
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\инструкция по установке.txt
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\config.vdf
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\dialogconfig.vdf
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c1
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\screen.jpg
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\applicantform_en.doc
- %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll.9
- %TEMP%\aute4b5.tmp
- %TEMP%\_mei7242\_ssl.pyd
- %TEMP%\_mei7242\base_library.zip
- %TEMP%\_mei7242\certifi\cacert.pem
- %TEMP%\_mei7242\pyexpat.pyd
- %TEMP%\_mei7242\python36.dll
- %TEMP%\_mei7242\select.pyd
- %TEMP%\_mei7242\sqlite3.dll
- %TEMP%\_mei7242\123.exe.manifest
- %TEMP%\_mei7242\unicodedata.pyd
- %TEMP%\_mei7242\_bz2.pyd
- %TEMP%\_mei7242\_ctypes.pyd
- %TEMP%\_mei7242\_hashlib.pyd
- %TEMP%\_mei7242\_lzma.pyd
- %TEMP%\_mei7242\_socket.pyd
- %TEMP%\_mei7242\_sqlite3.pyd
- %TEMP%\_mei7242\vcruntime140.dll
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\инструкция по установке.txt
- %APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c\map0
Moves the following files
- from %PROGRAMDATA%\meth.exe to %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.exe
Network activity
TCP
HTTP GET requests
- http://f0####03.xsph.ru/1.exe
- http://f0####03.xsph.ru/2.exe
UDP
- DNS ASK f0####03.xsph.ru
- DNS ASK ap#.#pify.org
- DNS ASK ip##i.co
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\meth.exe'
- '%PROGRAMDATA%\best.exe'
- '%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.exe'
- '%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe' a -y -mx9 -ssw "%APPDATA%\amd64_wsynth3dvsp.inf\ENU_684687FE972656442535.7z" "%APPDATA%\amd64_wsynth3dvsp.inf\ABC\*"
- '%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe' a -y -mx9 -ssw "%APPDATA%\amd64_wsynth3dvsp.inf\ENU_684687FE972656442535.7z" "%APPDATA%\amd64_wsynth3dvsp.inf\ABC\*"' (with hidden window)
- '%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.exe' ' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\amd64_wsynth3dvsp.inf"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\amd64_wsynth3dvsp.inf"
- '<SYSTEM32>\taskeng.exe' {2395FC8C-18CC-4995-A35E-D7C543D04A43} S-1-5-21-1960123792-2022915161-3775307078-1001:dtvefr\user:Interactive:[1]
