Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\msiexec
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\iexplore
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\wmvencod\lsass.exe
- %WINDIR%\syswow64\wmvencod\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- %WINDIR%\syswow64\taskmgr\msiexec.exe
- %WINDIR%\syswow64\taskmgr\133006b48fb54b65ec2045921283a18304e24d5a
- C:\documents and settings\wininit.exe
- C:\documents and settings\560854153607923c4c5f107085a7db67be01f252
- %WINDIR%\syswow64\msasn1\msiexec.exe
- %WINDIR%\syswow64\msasn1\133006b48fb54b65ec2045921283a18304e24d5a
- %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\taskhost.exe
- %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\b75386f1303e64d8139363b71e44ac16341adf4e
- %ProgramFiles(x86)%\internet explorer\iexplore\iexplore.exe
- %ProgramFiles(x86)%\internet explorer\iexplore\9db6e019d4f04ef534d0f91b3462d805c40e9d20
Network activity
Connects to
- '34.##1.160.28':80
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- 'C:\documents and settings\wininit.exe'
- 'C:\documents and settings\wininit.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'<SYSTEM32>\WMVENCOD\lsass.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "msiexec" /sc ONLOGON /tr "'<SYSTEM32>\taskmgr\msiexec.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\Documents and Settings\wininit.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "msiexec" /sc ONLOGON /tr "'<SYSTEM32>\msasn1\msiexec.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\taskhost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\iexplore\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
