Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\rnyuf.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im Manifest.com
Modifies file system
Creates the following files
- C:\iuafiuiiufyqyeofugasg\wget\manifest.com
- C:\iuafiuiiufyqyeofugasg\wget\it.bat
- C:\iuafiuiiufyqyeofugasg\wget\wget.vbs
- C:\iuafiuiiufyqyeofugasg\wget\generator
- C:\iuafiuiiufyqyeofugasg\wget\lop.bat
- C:\iuafiuiiufyqyeofugasg\wget\p77.vbs
- C:\iuafiuiiufyqyeofugasg\wget\footgame.exe
- %TEMP%\15211960123792202291
- %TEMP%\501c34ccf3\rnyuf.exe
- %TEMP%\152119601237
Deletes the following files
- C:\iuafiuiiufyqyeofugasg\wget\paymax.rar
- %TEMP%\152119601237
- C:\iuafiuiiufyqyeofugasg\wget\wget.vbs
- C:\iuafiuiiufyqyeofugasg\wget\manifest.com
- C:\iuafiuiiufyqyeofugasg\wget\footgame.exe
- C:\iuafiuiiufyqyeofugasg\wget\p77.vbs
Moves the following files
- from C:\iuafiuiiufyqyeofugasg\wget\generator to C:\iuafiuiiufyqyeofugasg\wget\paymax.rar
Network activity
Connects to
- 'te###unions.com':80
- 'fr###juss.com':80
TCP
HTTP POST requests
- http://te###unions.com/f6vskbW/index.php
- http://su###ongs.com/f6vskbW/index.php
- http://fr###juss.com/f6vskbW/index.php
- http://te###unions.com/f6vskbW/index.php?sc###
- http://fr###juss.com/f6vskbW/index.php?sc###
- http://su###ongs.com/f6vskbW/index.php?sc###
UDP
- DNS ASK te###unions.com
- DNS ASK su###ongs.com
- DNS ASK fr###juss.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\iuafiuiiufyqyeofugasg\wget\wget.vbs" /f=CREATE_NO_WINDOW install.cmd
- 'C:\iuafiuiiufyqyeofugasg\wget\manifest.com' e -psadui7f8at8iafds788afd7878 paymax.rar
- '%WINDIR%\syswow64\wscript.exe' "C:\iuafiuiiufyqyeofugasg\wget\p77.vbs"
- 'C:\iuafiuiiufyqyeofugasg\wget\footgame.exe' /start
- '%TEMP%\501c34ccf3\rnyuf.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\iuafiuiiufyqyeofugasg\wget\it.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\iuafiuiiufyqyeofugasg\wget\lop.bat" "' (with hidden window)
- '%TEMP%\501c34ccf3\rnyuf.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %TEMP%\501c34ccf3\' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "%TEMP%\501c34ccf3\rnyuf.exe" /F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\iuafiuiiufyqyeofugasg\wget\it.bat" "
- '%WINDIR%\syswow64\timeout.exe' 7
- '%WINDIR%\syswow64\timeout.exe' 6
- '%WINDIR%\syswow64\timeout.exe' 8
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\iuafiuiiufyqyeofugasg\wget\lop.bat" "
- '%WINDIR%\syswow64\attrib.exe' +s +h "C:\iuafiuiiufyqyeofugasg\wget"
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %TEMP%\501c34ccf3\
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "%TEMP%\501c34ccf3\rnyuf.exe" /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %TEMP%\501c34ccf3\
- '%WINDIR%\syswow64\attrib.exe' -s -h "C:\iuafiuiiufyqyeofugasg\wget"
- '%WINDIR%\syswow64\timeout.exe' 4
- '<SYSTEM32>\taskeng.exe' {139BA81B-95ED-4952-BA6D-55F0087DE5C9} S-1-5-21-1960123792-2022915161-3775307078-1001:wwvmgiqxdk\user:Interactive:[1]
