Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'system recover' = '"%ProgramFiles(x86)%\Google\Hajoxabazhi.exe"'
Modifies file system
Creates the following files
- %TEMP%\is-pp27l.tmp\<File name>.tmp
- %TEMP%\is-5n4iu.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5n4iu.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-5n4iu.tmp\idp.dll
- %TEMP%\is-5n4iu.tmp\waness.exe
- %TEMP%\84-c5b00-867-ddab4-c1fa08a2db87e\zhysholaeluwo.exe
- %TEMP%\84-c5b00-867-ddab4-c1fa08a2db87e\zhysholaeluwo.exe.config
- %TEMP%\74-10f41-c7f-929bf-8ba095683ff36\kenessey.txt
- %TEMP%\74-10f41-c7f-929bf-8ba095683ff36\fynaesedipu.exe
- %TEMP%\74-10f41-c7f-929bf-8ba095683ff36\fynaesedipu.exe.config
- %ProgramFiles(x86)%\google\hajoxabazhi.exe
- %ProgramFiles(x86)%\google\hajoxabazhi.exe.config
- %TEMP%\xmoebbf4.qao\gcleanereu.exe
Deletes the following files
- %TEMP%\is-5n4iu.tmp\idp.dll
- %TEMP%\is-5n4iu.tmp\waness.exe
- %TEMP%\is-5n4iu.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5n4iu.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-pp27l.tmp\<File name>.tmp
Network activity
Connects to
- 'ka########yama.s3.pl-waw.scw.cloud':80
- 'co###ctini.net':443
- 'microsoft.com':80
- 'na####.#3.pl-waw.scw.cloud':80
- 'do######.s3.pl-waw.scw.cloud':443
- 'google.com':80
- 'pr#######etrustednetwork.com':443
- '36####tracking.com':80
- '2.##.149.159':80
TCP
HTTP GET requests
- http://ka########yama.s3.pl-waw.scw.cloud/cul-pub/i-record.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://na####.#3.pl-waw.scw.cloud/jiraya/pub-Er48vQ7WjnpYHkzg.exe
- http://na####.#3.pl-waw.scw.cloud/jiraya/upda-EmPTk8Y5AwUVN3Uc.exe
- http://na####.#3.pl-waw.scw.cloud/jiraya/hand-7uHZR55Px4Ah5PxP.exe
- http://www.google.com/
- http://2.##.149.159/load.php?pu#########
HTTP POST requests
- http://36####tracking.com/r9ar6LZjtrWP2zWr/shinratensei
Other
- 'co###ctini.net':443
- 'ka########yama.s3.pl-waw.scw.cloud':443
- 'pr#######etrustednetwork.com':443
UDP
- DNS ASK ka########yama.s3.pl-waw.scw.cloud
- DNS ASK co###ctini.net
- DNS ASK microsoft.com
- DNS ASK na####.#3.pl-waw.scw.cloud
- DNS ASK do######.s3.pl-waw.scw.cloud
- DNS ASK google.com
- DNS ASK pr#######etrustednetwork.com
- DNS ASK 36####tracking.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\is-pp27l.tmp\<File name>.tmp' /SL5="$F0138,506127,422400,<Full path to file>"
- '%TEMP%\is-5n4iu.tmp\waness.exe' /S /UID=rec7
- '%TEMP%\84-c5b00-867-ddab4-c1fa08a2db87e\zhysholaeluwo.exe'
- '%TEMP%\74-10f41-c7f-929bf-8ba095683ff36\fynaesedipu.exe'
- '%TEMP%\xmoebbf4.qao\gcleanereu.exe' /eufive
- '%TEMP%\is-5n4iu.tmp\waness.exe' /S /UID=rec7' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\xmoebbf4.qao\GcleanerEU.exe /eufive & exit' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://www.pr#######etrustednetwork.com/e2q8zu9hu?ke##################################
- '<SYSTEM32>\cmd.exe' /k %TEMP%\xmoebbf4.qao\GcleanerEU.exe /eufive & exit
