Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\chrome
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\helpsvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\helpsvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\helpsvc\Parameters] 'ServiceDll' = '%LOCALAPPDATA%\Syfy9R3z.dat'
Creates the following services
- 'helpsvc' <SYSTEM32>\svchost.exe -k netsvcs
Modifies file system
Creates the following files
- %LOCALAPPDATA%\chrome.crx
- %LOCALAPPDATA%\chrome\icons\detailed\abp-48.png
- %LOCALAPPDATA%\chrome\icons\detailed\abp-32.png
- %LOCALAPPDATA%\chrome\icons\detailed\abp-128.png
- %LOCALAPPDATA%\chrome\icons\abp-40.png
- %LOCALAPPDATA%\chrome\icons\abp-40-whitelisted.png
- %LOCALAPPDATA%\chrome\icons\abp-40-notification-information.png
- %LOCALAPPDATA%\chrome\icons\abp-40-notification-critical.png
- %LOCALAPPDATA%\chrome\icons\detailed\abp-64.png
- %LOCALAPPDATA%\chrome\icons\abp-38.png
- %LOCALAPPDATA%\chrome\icons\abp-38-notification-information.png
- %LOCALAPPDATA%\chrome\icons\abp-38-notification-critical.png
- %LOCALAPPDATA%\chrome\icons\abp-32.png
- %LOCALAPPDATA%\chrome\icons\abp-32-whitelisted.png
- %LOCALAPPDATA%\chrome\icons\abp-32-notification-information.png
- %LOCALAPPDATA%\chrome\icons\abp-32-notification-critical.png
- %LOCALAPPDATA%\chrome\icons\abp-20.png
- %LOCALAPPDATA%\chrome\icons\abp-38-whitelisted.png
- %LOCALAPPDATA%\chrome\lib\adblockplus.js
- %LOCALAPPDATA%\chrome\lib\compat.js
- %LOCALAPPDATA%\chrome\lib\info.js
- %LOCALAPPDATA%\chrome\skin\social\twitter.png
- %LOCALAPPDATA%\chrome\skin\social\renren.png
- %LOCALAPPDATA%\chrome\skin\social\googleplus.png
- %LOCALAPPDATA%\chrome\skin\social\facebook.png
- %LOCALAPPDATA%\chrome\skin\popup.png
- %LOCALAPPDATA%\chrome\skin\popup.css
- %LOCALAPPDATA%\chrome\skin\firstrun.css
- %LOCALAPPDATA%\chrome\skin\donate.png
- %LOCALAPPDATA%\chrome\skin\devtools-panel.css
- %LOCALAPPDATA%\chrome\skin\common.css
- %LOCALAPPDATA%\chrome\skin\background.png
- %LOCALAPPDATA%\chrome\skin\background-share.png
- %LOCALAPPDATA%\chrome\skin\background-main.png
- %LOCALAPPDATA%\chrome\skin\ajax-loader.gif
- %LOCALAPPDATA%\chrome\skin\abb-logo.png
- %LOCALAPPDATA%\chrome\qunit\index.html
- %LOCALAPPDATA%\chrome\lib\publicsuffixlist.js
- %LOCALAPPDATA%\chrome\icons\abp-20-whitelisted.png
- %LOCALAPPDATA%\chrome\skin\social\weibo.png
- %LOCALAPPDATA%\chrome\icons\abp-20-notification-information.png
- %LOCALAPPDATA%\chrome\icons\abp-19.png
- %LOCALAPPDATA%\chrome\notification.js
- %LOCALAPPDATA%\chrome\messageresponder.js
- %LOCALAPPDATA%\chrome\manifest.json
- %LOCALAPPDATA%\chrome\managed-storage-schema.json
- %LOCALAPPDATA%\chrome\include.preload.js
- %LOCALAPPDATA%\chrome\include.postload.js
- %LOCALAPPDATA%\chrome\i18n.js
- %LOCALAPPDATA%\chrome\options.html
- %LOCALAPPDATA%\chrome\elemhideemulation.js
- %LOCALAPPDATA%\chrome\devtools-panel.html
- %LOCALAPPDATA%\chrome\devtools.js
- %LOCALAPPDATA%\chrome\devtools.html
- %LOCALAPPDATA%\chrome\composer.js
- %LOCALAPPDATA%\chrome\composer.html
- %LOCALAPPDATA%\chrome\common.js
- %LOCALAPPDATA%\chrome\background.js
- %LOCALAPPDATA%\chrome\devtools-panel.js
- %LOCALAPPDATA%\chrome\options.js
- %LOCALAPPDATA%\chrome\popup.html
- %LOCALAPPDATA%\chrome\popup.js
- %LOCALAPPDATA%\chrome\icons\abp-19-whitelisted.png
- %LOCALAPPDATA%\chrome\icons\abp-19-notification-information.png
- %LOCALAPPDATA%\chrome\icons\abp-19-notification-critical.png
- %LOCALAPPDATA%\chrome\icons\abp-16.png
- %LOCALAPPDATA%\chrome\icons\abp-16-whitelisted.png
- %LOCALAPPDATA%\chrome\icons\abp-16-notification-information.png
- %LOCALAPPDATA%\chrome\icons\abp-16-notification-critical.png
- %LOCALAPPDATA%\chrome\ext\popup.js
- %LOCALAPPDATA%\chrome\ext\devtools.js
- %LOCALAPPDATA%\chrome\ext\content.js
- %LOCALAPPDATA%\chrome\ext\common.js
- %LOCALAPPDATA%\chrome\ext\background.js
- %LOCALAPPDATA%\chrome\_locales\en_us\messages.json
- %LOCALAPPDATA%\chrome\utils.js
- %LOCALAPPDATA%\chrome\subscriptions.xml
- %LOCALAPPDATA%\chrome\stats.js
- %LOCALAPPDATA%\chrome\sec.vbs
- %LOCALAPPDATA%\chrome\icons\abp-20-notification-critical.png
- %LOCALAPPDATA%\syfy9r3z.dat
Network activity
UDP
- DNS ASK da#######0wtl.cloudfront.net
- DNS ASK vo###ools.com
Miscellaneous
Adds a root certificate
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\chrome\sec.vbs"
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "chrome" /tr %LOCALAPPDATA%\chrome\sec.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rundll32 "%LOCALAPPDATA%\Syfy9R3z.dat",DllUnInstall <Full path to file> %LOCALAPPDATA%\Syfy9R3z.dat' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\chrome\sec.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rundll32 "%LOCALAPPDATA%\Syfy9R3z.dat",Launch' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "chrome" /tr %LOCALAPPDATA%\chrome\sec.vbs
- '%WINDIR%\syswow64\cmd.exe' /c rundll32 "%LOCALAPPDATA%\Syfy9R3z.dat",DllUnInstall <Full path to file> %LOCALAPPDATA%\Syfy9R3z.dat
- '%WINDIR%\syswow64\rundll32.exe' "%LOCALAPPDATA%\Syfy9R3z.dat",DllUnInstall <Full path to file> %LOCALAPPDATA%\Syfy9R3z.dat
- '<SYSTEM32>\taskeng.exe' {7A909FD6-3944-4E08-924C-A510DD04123C} S-1-5-21-1960123792-2022915161-3775307078-1001:eouzhppb\user:Interactive:[1]
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --load-extension=%LOCALAPPDATA%\chrome --silent-launch --enable-automation
- '%WINDIR%\syswow64\cmd.exe' /c rundll32 "%LOCALAPPDATA%\Syfy9R3z.dat",Launch
- '%WINDIR%\syswow64\rundll32.exe' "%LOCALAPPDATA%\Syfy9R3z.dat",Launch
