Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\dwm
Modifies file system
Creates the following files
- %TEMP%\desktop.sfx.exe
- %TEMP%\wo7yghxwrq
- C:\documents and settings\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- C:\documents and settings\dwm.exe
- %WINDIR%\syswow64\eventcreate\cc11b995f2a76da408ea6a601e682e64743153ad
- %WINDIR%\syswow64\eventcreate\winlogon.exe
- %ALLUSERSPROFILE%\sun\java\java update\cc11b995f2a76da408ea6a601e682e64743153ad
- %ALLUSERSPROFILE%\sun\java\java update\winlogon.exe
- %WINDIR%\syswow64\wbem\devicepairinghandler\24dbde2999530ef5fd907494bc374d663924116c
- %WINDIR%\syswow64\wbem\devicepairinghandler\wmiprvse.exe
- %TEMP%\b6ytjnnsx3.bat
- C:\totalcmd\language\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- C:\far2\pluginsdk\headers.c\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- C:\far2\pluginsdk\headers.c\explorer.exe
- %WINDIR%\syswow64\proquota\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- %WINDIR%\syswow64\proquota\spoolsv.exe
- %TEMP%\defender_obf_protected.exe
- %TEMP%\ks4.021.3.10.391en_25104.exe
- %TEMP%\defender_obf_protected.sfx.exe
- %TEMP%\desktop.exe
- %TEMP%\ks4.021.3.10.391fi_25137.exe
- C:\totalcmd\language\audiodg.exe
- nul
Deletes the following files
- %TEMP%\wo7yghxwrq
Network activity
Connects to
- 'va#####fu.beget.tech':80
TCP
HTTP GET requests
- http://va#####fu.beget.tech/updategeneratorTraffic.php?ew#####################################################################################################################################
UDP
- DNS ASK va#####fu.beget.tech
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\desktop.sfx.exe'
- '%TEMP%\desktop.exe'
- '%TEMP%\defender_obf_protected.sfx.exe'
- '%TEMP%\defender_obf_protected.exe'
- 'C:\documents and settings\dwm.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\B6YTjNnSX3.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<SYSTEM32>\proquota\spoolsv.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.c\explorer.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'<SYSTEM32>\wbem\DevicePairingHandler\WmiPrvSE.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\winlogon.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\eventcreate\winlogon.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Documents and Settings\dwm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\B6YTjNnSX3.bat"
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\ping.exe' -n 5 localhost
