Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\wewrw
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\wewr
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\wininit
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\wewr.exe
- %ProgramFiles(x86)%\mozilla thunderbird\uninstall\9db6e019d4f04e
- %ProgramFiles(x86)%\mozilla thunderbird\uninstall\iexplore.exe
- <Current directory>\101b941d020240
- <Current directory>\lsm.exe
- C:\totalcmd\language\886983d96e3d3e
- C:\totalcmd\language\csrss.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6cb0b6c459d5d3
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\6203df4a6bafc7
- %ProgramFiles(x86)%\microsoft office\office10\wininit.exe
- %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\lsass.exe
- %ProgramFiles(x86)%\windows portable devices\csrss.exe
- C:\totalcmd\language\27d1bcfc3c54e0
- C:\totalcmd\language\system.exe
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\0fc223bdacedc3
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\firefox.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\b75386f1303e64
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe
- <Current directory>\09bd220b3294b5
- <Current directory>\wewr.exe
- %ProgramFiles(x86)%\windows portable devices\886983d96e3d3e
- %ProgramFiles(x86)%\microsoft office\office10\56085415360792
Network activity
Connects to
- '18#.#46.65.247':80
TCP
HTTP GET requests
- http://18#.#46.65.247/phptestDownloads.php?Os####################################################################################################################################################...
- http://18#.#46.65.247/phptestDownloads.php?VM####################################################################################################################################################...
UDP
- 'localhost':57705
- 'localhost':57114
- 'localhost':52074
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\wewr.exe'
- 'C:\totalcmd\language\system.exe'
- 'C:\totalcmd\language\system.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "wewrw" /sc MINUTE /mo 9 /tr "'<Current directory>\wewr.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office10\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 6 /tr "'<Current directory>\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'<Current directory>\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 10 /tr "'<Current directory>\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\Office10\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Windows Portable Devices\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wewrw" /sc MINUTE /mo 10 /tr "'<Current directory>\wewr.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wewr" /sc ONLOGON /tr "'<Current directory>\wewr.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office10\wininit.exe'" /rl HIGHEST /f
