Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Upblepdbj' = '"%APPDATA%\Nfjvv\Upblepdbj.exe"'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
Modifies file system
Creates the following files
- %APPDATA%\nfjvv\upblepdbj.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\softokn3.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\nss3.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\msvcp140.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\mozglue.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\freebl3.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-string-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-stdio-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\vcruntime140.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-math-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-locale-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-heap-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-environment-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-convert-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-conio-l1-1-0_not.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\license.xenarmor
- %LOCALAPPDATA%\c55665f0\plg\c039198306863035fea360c1237d8088.enc
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-multibyte-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\unknown.dll
Sets the 'hidden' attribute to the following files
- %WINDIR%\microsoft.net\framework\v4.0.30319\license.xenarmor
- %WINDIR%\microsoft.net\framework\v4.0.30319\unknown.dll
Deletes the following files
- %WINDIR%\microsoft.net\framework\v4.0.30319\license.xenarmor
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\nss3.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\msvcp140.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\mozglue.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\freebl3.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-string-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-stdio-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\softokn3.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-math-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-locale-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-heap-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-environment-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-convert-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-conio-l1-1-0_not.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\unknown.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\api-ms-win-crt-multibyte-l1-1-0.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\external\componentsext\vcruntime140.dll
Network activity
Connects to
- '37.#.11.155':4670
TCP
Other
- '37.#.11.155':4670
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 42' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 42
- '%WINDIR%\syswow64\timeout.exe' 42
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe' -a "%LOCALAPPDATA%\c55665f0\plg\mUqUbfsL.json"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe' -a "%TEMP%\unk.xml"
