Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\2
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\explorer
Modifies file system
Creates the following files
- %WINDIR%\gk3d7g2o8ijr2tytrtn4.exe
- C:\perflogs\admin\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- C:\perflogs\admin\explorer.exe
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\system.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\svchost.exe
- %ProgramFiles%\sporder\32356cded47552fbf8d1ae31f2de78071f48a92b
- %ProgramFiles%\sporder\2.exe
- C:\perflogs\admin\b75386f1303e64d8139363b71e44ac16341adf4e
- C:\perflogs\admin\svchost.exe
- C:\perflogs\admin\taskhost.exe
- C:\totalcmd\language\conhost.exe
- %TEMP%\d722f2753657147e65101c1f5c404550.dat
- C:\documents and settings\69ddcba757bf72f7d36c464c71f42baab150b2b9
- C:\documents and settings\smss.exe
- %WINDIR%\psvjmm2xyyc9fkee9ho41mczmdar5c.vbe
- %WINDIR%\2.exe
- %WINDIR%\i7tn2gjvos1drmdcu5a0crslsitm4u.bat
- %WINDIR%\bvslnrridw74jhfkrmp5hluojtuomz.bat
- %WINDIR%\wbflttjkr2u9bslsbahgcu0hwux2hc.vbe
- C:\totalcmd\language\088424020bedd6b28ac7fd22ee35dcd7322895ce
- C:\perflogs\admin\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
Network activity
TCP
HTTP GET requests
- http://da####1l.beget.tech/oeg1x9brqi3fdjsm1g3do7uovl8uyf10g6g4xki2hjks8r9avoe3vqelek5pcbw6dnlqpyr8w83y702n/oz3nsnnpmjr7t78sp0qi8ym62d5w/ad9a7a648b01e6c752a462d857e474ef1bbeb48a.php?ec#########...
- http://da####1l.beget.tech/oeg1x9brqi3fdjsm1g3do7uovl8uyf10g6g4xki2hjks8r9avoe3vqelek5pcbw6dnlqpyr8w83y702n/oz3nsnnpmjr7t78sp0qi8ym62d5w/ad9a7a648b01e6c752a462d857e474ef1bbeb48a.php?b5#########...
- http://da####1l.beget.tech/oeg1x9brqi3fdjsm1g3do7uovl8uyf10g6g4xki2hjks8r9avoe3vqelek5pcbw6dnlqpyr8w83y702n/oz3nsnnpmjr7t78sp0qi8ym62d5w/pwf1n8np5rsweu4yl8ojx14109ca4353oact0mtifvd5e9ygqznuqqbl...
UDP
- DNS ASK da####1l.beget.tech
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\wbfLtTjKr2U9bslsbAHgcu0hWuX2HC.vbe"
- '%WINDIR%\gk3d7g2o8ijr2tytrtn4.exe' -pcb689f1d9ff5a477951a914a47a0cac758bf4dc7
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\pSvJMM2xyYC9fkeE9HO41MCzMdAR5c.vbe"
- '%WINDIR%\2.exe'
- 'C:\perflogs\admin\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\bVSlnRRIdW74jhfKrMp5hlUOJTUomZ.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\i7TN2gjVOs1dRmdCU5A0CRSlSITM4U.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\bVSlnRRIdW74jhfKrMp5hlUOJTUomZ.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\i7TN2gjVOs1dRmdCU5A0CRSlSITM4U.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "2" /sc ONLOGON /tr "'%ProgramFiles%\sporder\2.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\PerfLogs\Admin\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\svchost.exe'" /rl HIGHEST /f
