Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost.exe' = '"%APPDATA%\svchost.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'svchost.exe' = '"%APPDATA%\svchost.exe" ..'
Creates or modifies the following files
- <SYSTEM32>\tasks\nyan
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchost.exe
Creates the following files on removable media
- <Drive name for removable media>:\svchost.exe
- <Drive name for removable media>:\correct.lnk
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM wscript.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM cmd.exe
Modifies file system
Creates the following files
- %APPDATA%\shellbag_analyzer_cleaner.exe
- %APPDATA%\svchost.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\svchost.exe
- %APPDATA%\svchost.exe
Deletes the following files
- <SYSTEM32>\tasks\nyan
Moves the following files
- from %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini to %TEMP%\57191
Network activity
Connects to
- 'microsoft.com':80
- 'oc##.#ectigo.com':80
- 'cr#.#ectigo.com':80
- '4.###.eu.ngrok.io':11154
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQ5suEceKjAJbxseAmHFkQ9FrhTWQQUDuE6qFM6MdWKvsG7rWcaA4WtNA4CEQCj%2B9rlQy7kTULybLJo4JMZ
- http://cr#.#ectigo.com/SectigoRSACodeSigningCA.crl
Other
- '4.###.eu.ngrok.io':11154
UDP
- DNS ASK microsoft.com
- DNS ASK oc##.#ectigo.com
- DNS ASK cr#.#ectigo.com
- DNS ASK 4.###.eu.ngrok.io
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\shellbag_analyzer_cleaner.exe'
- '%APPDATA%\svchost.exe'
- '%WINDIR%\syswow64\taskkill.exe' /F /IM wscript.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM cmd.exe' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn NYAN /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn NYAN /tr "%APPDATA%\svchost.exe" /sc minute /mo 1' (with hidden window)
- '%APPDATA%\svchost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn NYAN /F
- '%WINDIR%\syswow64\schtasks.exe' /create /tn NYAN /tr "%APPDATA%\svchost.exe" /sc minute /mo 1
- '<SYSTEM32>\taskeng.exe' {4ABAD720-C929-4384-8375-77BEDC5436CD} S-1-5-21-1960123792-2022915161-3775307078-1001:shumsciyr\user:Interactive:[1]
