Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\update\dfc576c6-db9d-4353-b001-ca2e2f5f039c
Changes the following executable system files
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\microsoft\upnp device host\upnphost\udhisapi.dll
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ALLUSERSPROFILE%\VideoCodecs.exe" "VideoCodecs.exe" ENABLE
Injects code into
the following user processes:
- videocodecs.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\videocodecs.exe
- %TEMP%\tmp1644003240.tmp
- %TEMP%\dfc576c6-db9d-4353-b001-ca2e2f5f039c.exe
- %TEMP%\afd2ebcd-d1f7-4888-b1b6-679ff6e360b0\1979419174.vbs
- %TEMP%\afd2ebcd-d1f7-4888-b1b6-679ff6e360b0\video-(1)-march-10-2017.mp4
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\videocodecs.exe
Deletes the following files
- %TEMP%\afd2ebcd-d1f7-4888-b1b6-679ff6e360b0\1979419174.vbs
Network activity
UDP
- DNS ASK cv############df8723894723klsdjsdfsdf.publicvm.com
- 'ff#2::c':1900
- '23#.#55.255.250':1900
Miscellaneous
Searches for the following windows
- ClassName: 'WMPlayerApp' WindowName: ''
- ClassName: '\MSITPro::EventQueue' WindowName: ''
- ClassName: 'Type32_Main_Window' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\videocodecs.exe'
- '%TEMP%\dfc576c6-db9d-4353-b001-ca2e2f5f039c.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\afd2ebcd-d1f7-4888-b1b6-679ff6e360b0\1979419174.vbs"
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Update\dfc576c6-db9d-4353-b001-ca2e2f5f039c" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\dfc576c6-db9d-4353-b001-ca2e2f5f039c" /XML "%TEMP%\tmp1644003240.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /K "%ALLUSERSPROFILE%\VideoCodecs.exe"' (with hidden window)
- '%TEMP%\dfc576c6-db9d-4353-b001-ca2e2f5f039c.exe' ' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ALLUSERSPROFILE%\VideoCodecs.exe" "VideoCodecs.exe" ENABLE' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Update\dfc576c6-db9d-4353-b001-ca2e2f5f039c" /F
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Update\dfc576c6-db9d-4353-b001-ca2e2f5f039c" /XML "%TEMP%\tmp1644003240.tmp"
- '%WINDIR%\syswow64\cmd.exe' /K "%ALLUSERSPROFILE%\VideoCodecs.exe"
- '%ProgramFiles(x86)%\windows media player\wmplayer.exe' /prefetch:6 /Open "%TEMP%\afd2ebcd-d1f7-4888-b1b6-679ff6e360b0\Video-(1)-March-10-2017.mp4"
- '%ProgramFiles(x86)%\windows media player\setup_wm.exe' /SysTrayAndQuit
