Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'K6L0HZAPKB' = '%ProgramFiles(x86)%\Kdr4pdxfp\IconCachewfil_r.exe'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Executes the following (exploit)
- '%ProgramFiles%\microsoft office\office14\excel.exe' /dde
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\autofmt.exe
Modifies file system
Creates the following files
- %TEMP%\a9r1oryhf4_xp2e6a_1l0.tmp\has been verified. however pdf, jpeg, docx, .xlsx
- %TEMP%\a9r1oryhf4_xp2e6a_1l0.tmp\~$has been verified. however pdf, jpeg, docx, .xlsx
- %TEMP%\24cf.tmp
- C:\users\public\vbc.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
Deletes the following files
- C:\users\public\vbc.exe
Network activity
Connects to
- '10#.#75.3.11':80
- 'mi###aminos.com':80
- 'mu####bet269.com':80
- 'je###cabu.com':80
- 'se##ax.com':80
- 'sl##erg.com':80
- 'sh#####ucollective.com':80
- 'mb####nphoto.com':80
- 'cz##lzl.com':80
- 'ca####lshubs.com':80
TCP
HTTP GET requests
- http://10#.#75.3.11/sug1/sug1.exe
- http://www.mi###aminos.com/pogm/?PB##########################################################################################
- http://www.mu####bet269.com/pogm/?PB##########################################################################################
- http://www.je###cabu.com/pogm/?PB##########################################################################################
- http://www.se##ax.com/pogm/?PB##########################################################################################
- http://www.sl##erg.com/pogm/?PB##########################################################################################
- http://www.sh#####ucollective.com/pogm/?PB##########################################################################################
- http://www.mb####nphoto.com/pogm/?PB##########################################################################################
- http://www.cz##lzl.com/pogm/?PB##########################################################################################
- http://www.ca####lshubs.com/pogm/?PB##########################################################################################
UDP
- DNS ASK mi###aminos.com
- DNS ASK mu####bet269.com
- DNS ASK je###cabu.com
- DNS ASK se##ax.com
- DNS ASK sl##erg.com
- DNS ASK hn##cs.com
- DNS ASK sh#####ucollective.com
- DNS ASK wr###bynick.com
- DNS ASK mb####nphoto.com
- DNS ASK ma###est.com
- DNS ASK cz##lzl.com
- DNS ASK ca####lshubs.com
- DNS ASK yo##y7.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'XLMAIN' WindowName: 'Microsoft Excel (Product Activation Failed) - Book1'
- ClassName: 'XLMAIN' WindowName: ''
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmmon32.exe'
- '%WINDIR%\syswow64\cmd.exe' del "C:\Users\Public\vbc.exe"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
