Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ZSzTpwPYthEOlGQGbCAZRXynvYZ' = 'explorer.exe "%WINDIR%\Resources\Themes\RCItahqzbmrYjvmhbSOWEQ\svchost.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Resources\Themes\RCItahqzbmrYjvmhbSOWEQ\svchost.exe' = '00000000'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\itujgcdkaeksnbsbrherceslf\<File name>.exe_url_1jwzu2o5mb31konbjwjfailiaslhwkv0\2.808.588.370\pjmuano0.newcfg
- %WINDIR%\resources\themes\rcitahqzbmryjvmhbsoweq\svchost.exe
Moves the following files
- from %LOCALAPPDATA%\itujgcdkaeksnbsbrherceslf\<File name>.exe_url_1jwzu2o5mb31konbjwjfailiaslhwkv0\2.808.588.370\pjmuano0.newcfg to %LOCALAPPDATA%\itujgcdkaeksnbsbrherceslf\<File name>.exe_url_1jwzu2o5mb31konbjwjfailiaslhwkv0\2.808.588.370\user.config
Network activity
Connects to
- 'microsoft.com':80
- 'ch###eafc.com':80
- 'ch###eafc.com':443
- 'ma##td.com':80
- 'ma##td.com':443
- 'ma##ity.com':80
- 'ma##ity.com':443
- '0k#####1kkeok2e.online':80
- 'li###poolfc.com':80
- 'li###poolfc.com':443
- 'x.##2.us':80
- 're###adrid.com':80
- 're###adrid.com':443
TCP
HTTP GET requests
- http://0k#####1kkeok2e.online/base/B4E1D102881DF8023D6B1A3D0458A0D5.html
- http://0k#####1kkeok2e.online/base/81F40D48D70B8FCA4495D280E253A5F6.html
UDP
- DNS ASK microsoft.com
- DNS ASK ch###eafc.com
- DNS ASK ma##td.com
- DNS ASK ma##ity.com
- DNS ASK 0k#####1kkeok2e.online
- DNS ASK li###poolfc.com
- DNS ASK x.##2.us
- DNS ASK re###adrid.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\RCItahqzbmrYjvmhbSOWEQ\svchost.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout 1' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\RCItahqzbmrYjvmhbSOWEQ\svchost.exe" -Force
- '%WINDIR%\syswow64\cmd.exe' /c timeout 1
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem" /xml "%TEMP%\tmp3330.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem Task" /xml "%TEMP%\tmp3505.tmp"
