Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'windows0x64' = '%APPDATA%\Microsoft\windows0x64\svchost.vbs'
Modifies file system
Creates the following files
- %TEMP%\fd13.tmp\fd14.tmp\fd15.bat
- %TEMP%\18ae.tmp\copy.vbs
- %APPDATA%\microsoft\windows0x64\windows0x64.bat
- %APPDATA%\microsoft\windows0x64\win.bat
- %APPDATA%\microsoft\windows0x64\verus-solver.exe
- %APPDATA%\microsoft\windows0x64\update.vbs
- %APPDATA%\microsoft\windows0x64\svchost.vbs
- %APPDATA%\microsoft\windows0x64\start.vbs
- %APPDATA%\microsoft\windows0x64\setup.bat
- %APPDATA%\microsoft\windows0x64\run.bat
- %APPDATA%\microsoft\windows0x64\install.vbs
- %APPDATA%\microsoft\windows0x64\install.bat
- %APPDATA%\microsoft\windows0x64\copy.exe
- %APPDATA%\microsoft\windows0x64\checkkk.ps1
- %APPDATA%\microsoft\windows0x64\check.bat
- %TEMP%\fd13.tmp\windows0x64.bat
- %TEMP%\fd13.tmp\win.bat
- %TEMP%\fd13.tmp\verus-solver.exe
- %TEMP%\fd13.tmp\update.vbs
- %TEMP%\fd13.tmp\svchost.vbs
- %TEMP%\fd13.tmp\start.vbs
- %TEMP%\fd13.tmp\setup.bat
- %TEMP%\fd13.tmp\run.bat
- %TEMP%\fd13.tmp\install.vbs
- %TEMP%\fd13.tmp\install.bat
- %TEMP%\fd13.tmp\copy.exe
- %TEMP%\fd13.tmp\checkkk.ps1
- %TEMP%\fd13.tmp\check.bat
- %TEMP%\fd13.tmp\30894.bat
- %APPDATA%\microsoft\windows0x64\30894.bat
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows0x64\verus-solver.exe
- %APPDATA%\microsoft\windows0x64\install.vbs
- %APPDATA%\microsoft\windows0x64\svchost.vbs
- %APPDATA%\microsoft\windows0x64\setup.bat
- %APPDATA%\microsoft\windows0x64\start.vbs
- %APPDATA%\microsoft\windows0x64\check.bat
- %APPDATA%\microsoft\windows0x64\update.vbs
- %APPDATA%\microsoft\windows0x64\run.bat
- %APPDATA%\microsoft\windows0x64\windows0x64.bat
- %APPDATA%\microsoft\windows0x64\install.bat
- %APPDATA%\microsoft\windows0x64\copy.exe
- %APPDATA%\microsoft\windows0x64\checkkk.ps1
- %APPDATA%\microsoft\windows0x64\win.bat
Deletes the following files
- %TEMP%\fd13.tmp\fd14.tmp\fd15.bat
- %TEMP%\18ae.tmp\copy.vbs
- %TEMP%\fd13.tmp\check.bat
- %TEMP%\fd13.tmp\checkkk.ps1
- %TEMP%\fd13.tmp\copy.exe
- %TEMP%\fd13.tmp\install.bat
- %TEMP%\fd13.tmp\install.vbs
- %TEMP%\fd13.tmp\run.bat
- %TEMP%\fd13.tmp\start.vbs
- %TEMP%\fd13.tmp\svchost.vbs
- %TEMP%\fd13.tmp\update.vbs
- %TEMP%\fd13.tmp\verus-solver.exe
- %TEMP%\fd13.tmp\win.bat
- %TEMP%\fd13.tmp\windows0x64.bat
- %APPDATA%\microsoft\windows0x64\30894.bat
Network activity
TCP
- 'gi##ub.com':443
UDP
- DNS ASK gi##ub.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %TEMP%\18AE.tmp\copy.vbs
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"
- '%APPDATA%\microsoft\windows0x64\copy.exe'
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\svchost.vbs"
- '<SYSTEM32>\cscript.exe' //nologo //E:JScript.Encode "%APPDATA%\Microsoft\windows0x64\windows0x64.bat"
- '<SYSTEM32>\wscript.exe' "%TEMP%\FD13.tmp\install.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\setup.bat" "' (with hidden window)
- '%APPDATA%\microsoft\windows0x64\copy.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\install.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\check.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\windows0x64.bat" "' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\windows0x64\start.vbs"' (with hidden window)
- '<SYSTEM32>\wscript.exe' %TEMP%\18AE.tmp\copy.vbs' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\check.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\win.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\FD13.tmp\FD14.tmp\FD15.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\FD13.tmp\FD14.tmp\FD15.bat <Full path to file>"
- '<SYSTEM32>\attrib.exe' +s +h checkkk.ps1
- '<SYSTEM32>\attrib.exe' +s +h copy.exe
- '<SYSTEM32>\attrib.exe' +s +h install.bat
- '<SYSTEM32>\attrib.exe' +s +h windows0x64.bat
- '<SYSTEM32>\attrib.exe' +s +h run.bat
- '<SYSTEM32>\attrib.exe' +s +h final.exe
- '<SYSTEM32>\attrib.exe' +s +h update.vbs
- '<SYSTEM32>\attrib.exe' +s +h check.bat
- '<SYSTEM32>\attrib.exe' +s +h start.vbs
- '<SYSTEM32>\attrib.exe' +s +h setup.bat
- '<SYSTEM32>\attrib.exe' +s +h svchost.vbs
- '<SYSTEM32>\attrib.exe' +s +h install.vbs
- '<SYSTEM32>\attrib.exe' +s +h verus-solver.exe
- '<SYSTEM32>\attrib.exe' +s +h windows0x64.exe
- '<SYSTEM32>\find.exe' /I /N "Taskmgr.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq Taskmgr.exe"
- '<SYSTEM32>\cscript.exe' //nologo //E:JScript.Encode "%TEMP%\FD13.tmp\windows0x64.bat"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\check.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\windows0x64.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\check.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\windows0x64.bat" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -File checkkk.ps1
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\windows0x64\win.bat" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:temp
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "windows0x64" /t REG_SZ /d ""%APPDATA%"\Microsoft\windows0x64\svchost.vbs" /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\install.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\FD13.tmp\setup.bat" "
- '<SYSTEM32>\attrib.exe' +s +h win.bat
- '<SYSTEM32>\attrib.exe' +s +h windows0x64
