Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'excel' = '%TEMP%\excel\excel.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdater' = '"%TEMP%\Kgsenjjxs.exe" ..'
Creates or modifies the following files
- <SYSTEM32>\tasks\nafifas
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdater.lnk
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe
Searches for registry branches where third party applications store passwords
- [<HKLM>\Software\Wow6432Node\ORL\WinVNC3]
- [<HKCU>\Software\ORL\WinVNC3]
- [<HKCU>\SOFTWARE\FTPWare\COREFTP\Sites]
- [<HKCU>\Software\RimArts\B2\Settings]
- [<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %APPDATA%\doci\doci.exe
- %TEMP%\vnrjlhievriip.exe
- %TEMP%\kgsenjjxs.exe
- %TEMP%\excel\excel.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %LOCALAPPDATA%\get_cliboard_address\kgsenjjxs.exe_url_ktged4cp2uvq2ynul5jd1cm3j1vsznsq\1.0.0.0\jnlukzg9.newcfg
Sets the 'hidden' attribute to the following files
- %TEMP%\excel\excel.exe
- %TEMP%\kgsenjjxs.exe
Deletes the following files
- %TEMP%\excel\excel.exe
Moves the following files
- from %TEMP%\vnrjlhievriip.exe to %TEMP%\tmpg791.tmp
- from %LOCALAPPDATA%\get_cliboard_address\kgsenjjxs.exe_url_ktged4cp2uvq2ynul5jd1cm3j1vsznsq\1.0.0.0\jnlukzg9.newcfg to %LOCALAPPDATA%\get_cliboard_address\kgsenjjxs.exe_url_ktged4cp2uvq2ynul5jd1cm3j1vsznsq\1.0.0.0\user.config
- from %TEMP%\vnrjlhievriip.exe to %TEMP%\tmpg175.tmp
Substitutes the following files
- %TEMP%\vnrjlhievriip.exe
- %TEMP%\excel\excel.exe
Network activity
Connects to
- '10#.#82.129.59':80
TCP
HTTP POST requests
- http://10#.#82.129.59/t1/bray/inc/a57dbd02fd3e31.php
Miscellaneous
Creates and executes the following
- '%TEMP%\vnrjlhievriip.exe'
- '%TEMP%\kgsenjjxs.exe'
- '%APPDATA%\doci\doci.exe'
- '%APPDATA%\doci\doci.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe'
- '%WINDIR%\syswow64\cmd.exe' /c mkdir "%APPDATA%\doci"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\doci\doci.exe'" /f
- '%WINDIR%\syswow64\cmd.exe' /c copy "<Full path to file>" "%APPDATA%\doci\doci.exe"
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\doci\doci.exe'" /f
- '<SYSTEM32>\taskeng.exe' {41780B64-C560-4222-8C58-12B67D2FDBE4} S-1-5-21-1960123792-2022915161-3775307078-1001:vsioescpwbb\user:Interactive:[1]
- '%WINDIR%\syswow64\cmd.exe' /c copy "%APPDATA%\doci\doci.exe" "%APPDATA%\doci\doci.exe"
