Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'msiexec' = '"C:\dllwin\msiexec.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"C:\Documents and Settings\dwm.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<Current directory>\csrss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"C:\totalcmd\LANGUAGE\services.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"<Current directory>\audiodg.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\Far2\PluginSDK\Headers.pas\spoolsv.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\PerfLogs\Admin\iexplore.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winfont' = '"C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\winfont.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%WINDIR%\Fonts\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\msiexec
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\winfont
Modifies file system
Creates the following files
- C:\dllwin\elwjdwxzgeo2jvvhccjv.exe
- %WINDIR%\fonts\csrss.exe
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\7d279732e56fcb3a87f5d569c79e4db164d84b33
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\winfont.exe
- C:\perflogs\admin\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- C:\perflogs\admin\iexplore.exe
- C:\far2\pluginsdk\headers.pas\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- C:\far2\pluginsdk\headers.pas\spoolsv.exe
- <Current directory>\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- <Current directory>\audiodg.exe
- C:\totalcmd\language\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
- C:\totalcmd\language\services.exe
- <Current directory>\886983d96e3d3e31032c679b2d4ea91b6c05afef
- <Current directory>\csrss.exe
- C:\documents and settings\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- C:\documents and settings\dwm.exe
- C:\dllwin\133006b48fb54b65ec2045921283a18304e24d5a
- C:\dllwin\msiexec.exe
- C:\dllwin\jukxxjylyzjwrmi77vgfamwwbrusiy.vbe
- C:\dllwin\winfont.exe
- C:\dllwin\pdwytnxziotuytco2g2f4kqxju7wkn.bat
- C:\dllwin\cc9tulosw6mqrxyidojqjr3uuxqmpf.bat
- C:\dllwin\uvjrcst5wm4kngeh6e7py9hi5ncmrb.bat
- C:\dllwin\ftq1khtv7kkwvhvdji0jqnikbwv9dp.vbe
- %WINDIR%\fonts\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %TEMP%\a34bd4e212377a58cb8418a163e76564d021cb18feda41b5f22581b37c9a261b8b1749f2bc640e23
Network activity
Connects to
- 'f0####22.xsph.ru':80
TCP
HTTP GET requests
- http://f0####22.xsph.ru/pz87zw936kdnbdf4iko442rh7u28s0rqf6v9vs7rayodls1w6/8m7ptdt4k8kcw5qlzikfuq5gopsbbx3m2r4vqicy12a1lsqvjev0czt0tlo75d8/42cd0d9866ff3558520c91302516a017d93fd0bf.php?RY########...
UDP
- DNS ASK f0####22.xsph.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\dllwin\FTQ1KhtV7KKWVhVDji0jQnikBwv9DP.vbe"
- 'C:\dllwin\elwjdwxzgeo2jvvhccjv.exe' -pcc66f18f2a237d174de7202386281e1f0e51a80a
- '%WINDIR%\syswow64\wscript.exe' "C:\dllwin\jukxxJYlYzJwrMI77VgFAMWwBRUSIy.vbe"
- 'C:\dllwin\winfont.exe'
- '%WINDIR%\fonts\csrss.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dllwin\UVjrCSt5wM4knGeH6E7pY9hI5ncMRb.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dllwin\PDWYTnxZIOTUYtco2G2f4KqXJU7wkn.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dllwin\UVjrCSt5wM4knGeH6E7pY9hI5ncMRb.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dllwin\cc9TUlosw6mQrxYidojQjR3uUXqmPf.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c "echo injekt file"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dllwin\PDWYTnxZIOTUYtco2G2f4KqXJU7wkn.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "msiexec" /sc ONLOGON /tr "'C:\dllwin\msiexec.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Documents and Settings\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'<Current directory>\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\PerfLogs\Admin\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winfont" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\winfont.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\Fonts\csrss.exe'" /rl HIGHEST /f
