Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\totalcmd\LANGUAGE\lsass.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<Current directory>\taskhost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Internet Explorer\sqmapi\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Documents and Settings\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"<SYSTEM32>\NlsLexicons0013\lsm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\Users\Default User\Idle.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\coloader\mdm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"<SYSTEM32>\C_10003\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\efsutil\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\ksetup\dwm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\C_1142\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\dwm
Modifies file system
Creates the following files
- C:\totalcmd\language\lsass.exe
- <SYSTEM32>\ksetup\6cb0b6c459d5d3
- <SYSTEM32>\ksetup\dwm.exe
- <SYSTEM32>\efsutil\886983d96e3d3e
- <SYSTEM32>\efsutil\csrss.exe
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.5\101b941d020240
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.5\lsm.exe
- <SYSTEM32>\c_10003\56085415360792
- <SYSTEM32>\c_10003\wininit.exe
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\559fba5f8e4410
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\mdm.exe
- C:\users\default user\6ccacd8608530f
- C:\users\default user\idle.exe
- <SYSTEM32>\nlslexicons0013\101b941d020240
- <SYSTEM32>\nlslexicons0013\lsm.exe
- C:\documents and settings\9db6e019d4f04e
- C:\documents and settings\iexplore.exe
- %ProgramFiles(x86)%\internet explorer\sqmapi\9db6e019d4f04e
- %ProgramFiles(x86)%\internet explorer\sqmapi\iexplore.exe
- <Current directory>\b75386f1303e64
- <Current directory>\taskhost.exe
- C:\totalcmd\language\6203df4a6bafc7
- <SYSTEM32>\c_1142\csrss.exe
- <SYSTEM32>\c_1142\886983d96e3d3e
Network activity
Connects to
- '18#.#6.10.37':80
TCP
HTTP GET requests
- http://18#.#6.10.37/3processor/Lowvm/57/flowerVmJs/7LowApiMariadb/63/8/44Linux/TrafficGeo_8/3Processprovider_/vm6/LinuxBase/privateMulti/processProcessGenerator/updateasync.php?Ay##############...
- http://18#.#6.10.37/3processor/Lowvm/57/flowerVmJs/7LowApiMariadb/63/8/44Linux/TrafficGeo_8/3Processprovider_/vm6/LinuxBase/privateMulti/processProcessGenerator/updateasync.php?xt##############...
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.5\lsm.exe'
- '<Full path to file>' ' (with hidden window)
- '%ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.5\lsm.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\sqmapi\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Documents and Settings\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'<SYSTEM32>\NlsLexicons0013\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\coloader\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<SYSTEM32>\C_10003\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\efsutil\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\ksetup\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\C_1142\csrss.exe'" /rl HIGHEST /f
