Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\<File name>u
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\firefoxf
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\mntemp
- C:\far2\pluginsdk\20ef9a6b0d1573
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\winlogon.exe
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\cc11b995f2a76d
- C:\totalcmd\language\iexplore.exe
- C:\totalcmd\language\9db6e019d4f04e
- %ProgramFiles%\outpost\winlogon.exe
- C:\totalcmd\language\559fba5f8e4410
- C:\far2\pluginsdk\<File name>.exe
- %ProgramFiles%\outpost\cc11b995f2a76d
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\wininit.exe
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\56085415360792
- %WINDIR%\offline web pages\firefox.exe
- %WINDIR%\offline web pages\0fc223bdacedc3
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\f3b6ecef712a24
- <Current directory>\wininit.exe
- <Current directory>\56085415360792
- C:\totalcmd\language\mdm.exe
- C:\far2\addons\macros\9db6e019d4f04e
- C:\far2\addons\macros\iexplore.exe
- C:\totalcmd\language\b75386f1303e64
- C:\totalcmd\language\wudfhost.exe
- C:\totalcmd\language\480b7989c529f6
- %ProgramFiles%\wish\lsass.exe
- %ProgramFiles%\wish\6203df4a6bafc7
- %TEMP%\izdsb0puxu
- %TEMP%\wpwk71okfk.bat
- C:\totalcmd\language\taskhost.exe
- nul
- <Current directory>\69ddcba757bf72
- <Current directory>\winlogon.exe
- <Current directory>\cc11b995f2a76d
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\packages\debugger\system.exe
- %ProgramFiles(x86)%\microsoft visual studio 8\common7\packages\debugger\27d1bcfc3c54e0
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\b75386f1303e64
- <Current directory>\smss.exe
- C:\users\default user\iexplore.exe
- C:\users\default user\9db6e019d4f04e
Deletes the following files
- %TEMP%\izdsb0puxu
Network activity
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\taskhost.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\WUDFHost.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\wish\lsass.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\winlogon.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\smss.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Addons\Macros\iexplore.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\mdm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\outpost\winlogon.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\PluginSDK\<File name>.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\iexplore.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\wininit.exe'
- 'C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\winlogon.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\WPWK71oKFk.bat"' (with hidden window)
- 'C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\winlogon.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\outpost\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles%\outpost\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\outpost\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'<Current directory>\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<Current directory>\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'<Current directory>\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'%WINDIR%\Offline Web Pages\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\Offline Web Pages\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 13 /tr "'%WINDIR%\Offline Web Pages\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Users\Default User\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\System.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\winlogon.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\Offline Web Pages\firefox.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>u" /sc MINUTE /mo 11 /tr "'C:\Far2\PluginSDK\<File name>.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\wininit.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'C:\Far2\PluginSDK\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 14 /tr "'C:\totalcmd\LANGUAGE\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\wish\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%ProgramFiles%\wish\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\wish\lsass.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\WPWK71oKFk.bat"
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 12 /tr "'<Current directory>\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'<Current directory>\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'C:\Far2\Addons\Macros\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Addons\Macros\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'C:\Far2\Addons\Macros\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>u" /sc MINUTE /mo 7 /tr "'C:\Far2\PluginSDK\<File name>.exe'" /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\iexplore.exe'
