Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\hyperreview
- <SYSTEM32>\tasks\hyperreviewh
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\1280x1024
- <SYSTEM32>\tasks\1280x10241
Modifies file system
Creates the following files
- %TEMP%\hyperreview.exe
- %WINDIR%\en-us\b75386f1303e64
- %HOMEPATH%\spoolsv.exe
- %HOMEPATH%\f3b6ecef712a24
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\firefox.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\0fc223bdacedc3
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\886983d96e3d3e
- %WINDIR%\en-us\taskhost.exe
- <Current directory>\csrss.exe
- %ALLUSERSPROFILE%\mozilla\logs\d7ed84c1bc0b7d
- %HOMEPATH%\idle.exe
- %HOMEPATH%\6ccacd8608530f
- %WINDIR%\vss\writers\system\1280x1024.exe
- %WINDIR%\vss\writers\system\98af1be0b329b9
- <Current directory>\886983d96e3d3e
- %ALLUSERSPROFILE%\mozilla\logs\hyperreview.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\886983d96e3d3e
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\csrss.exe
- %ProgramFiles(x86)%\internet explorer\en-us\spoolsv.exe
- %ProgramFiles(x86)%\internet explorer\en-us\f3b6ecef712a24
- <Current directory>\taskhost.exe
- <Current directory>\b75386f1303e64
- %HOMEPATH%\templates\lsm.exe
- %HOMEPATH%\templates\101b941d020240
- %TEMP%\1280x1024.exe
- <Current directory>\services.exe
- C:\msocache\all users\firefox.exe
- C:\msocache\all users\0fc223bdacedc3
- C:\far2\documentation\rus\wudfhost.exe
- C:\far2\documentation\rus\480b7989c529f6
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\f3b6ecef712a24
- <Current directory>\c5b4cb5e9653cc
- C:\far2\encyclopedia\tap\csrss.exe
- C:\far2\encyclopedia\tap\886983d96e3d3e
Network activity
Connects to
- 'f0####81.xsph.ru':80
TCP
HTTP GET requests
- http://f0####81.xsph.ru/vmdbwp.php?Yy############################################################################################################################################################...
- http://f0####81.xsph.ru/vmdbwp.php?RB############################################################################################################################################################...
UDP
- DNS ASK f0####81.xsph.ru
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '%TEMP%\1280x1024.exe'
- ClassName: '#32771' WindowName: ''
Creates and executes the following
- '%TEMP%\hyperreview.exe'
- '%TEMP%\1280x1024.exe'
- 'C:\far2\documentation\rus\wudfhost.exe'
- 'C:\far2\documentation\rus\wudfhost.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Internet Explorer\en-US\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%WINDIR%\en-US\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'%WINDIR%\en-US\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'%HOMEPATH%\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%HOMEPATH%\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'%HOMEPATH%\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'<Current directory>\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "hyperreviewh" /sc MINUTE /mo 5 /tr "'%ALLUSERSPROFILE%\Mozilla\logs\hyperreview.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "hyperreview" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Mozilla\logs\hyperreview.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "hyperreviewh" /sc MINUTE /mo 11 /tr "'%ALLUSERSPROFILE%\Mozilla\logs\hyperreview.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%HOMEPATH%\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%HOMEPATH%\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'%HOMEPATH%\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "1280x10241" /sc MINUTE /mo 14 /tr "'%WINDIR%\Vss\Writers\System\1280x1024.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "1280x1024" /sc ONLOGON /tr "'%WINDIR%\Vss\Writers\System\1280x1024.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "1280x10241" /sc MINUTE /mo 14 /tr "'%WINDIR%\Vss\Writers\System\1280x1024.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Far2\Encyclopedia\tap\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Far2\Encyclopedia\tap\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'%WINDIR%\en-US\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 6 /tr "'<Current directory>\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\en-US\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Internet Explorer\en-US\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'<Current directory>\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 14 /tr "'%HOMEPATH%\Templates\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%HOMEPATH%\Templates\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 7 /tr "'%HOMEPATH%\Templates\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 13 /tr "'<Current directory>\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 5 /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\MSOCache\All Users\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\Far2\Documentation\rus\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Far2\Documentation\rus\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 9 /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
