Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"C:\msChainServerRuntime\firefox.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"C:\msChainServerRuntime\firefox.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\msChainServerRuntime\firefox.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\msChainServerRuntime\firefox.exe", "%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\msChainServerRuntime\wininit.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\msChainServerRuntime\wininit.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\msChainServerRuntime\firefox.exe", "%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe", "C:\msChain...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\wininit.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\wininit.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"%WINDIR%\PolicyDefinitions\en-US\System.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"%WINDIR%\PolicyDefinitions\en-US\System.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\system
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\msChainServerRuntime\wininit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\msChainServerRuntime\firefox.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/msChainServerRuntime/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/bpcqbk/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\wininit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\PolicyDefinitions\en-US\System.exe'
Modifies file system
Creates the following files
- C:\mschainserverruntime\blockagentbrowserhostdll.exe
- %HOMEPATH%\desktop\ryyclhnz.log
- %HOMEPATH%\desktop\zmxwrmtk.log
- C:\mschainserverruntime\firefox.exe
- C:\mschainserverruntime\0fc223bdacedc3
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\firefox.exe
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\0fc223bdacedc3
- C:\mschainserverruntime\wininit.exe
- %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\wininit.exe
- %TEMP%\tn6btq5xkk.bat
- %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\56085415360792
- %WINDIR%\policydefinitions\en-us\system.exe
- %WINDIR%\policydefinitions\en-us\27d1bcfc3c54e0
- %TEMP%\isjuswil.0.cs
- %TEMP%\isjuswil.cmdline
- %TEMP%\isjuswil.out
- %TEMP%\1ggfvowpuy
- %HOMEPATH%\desktop\jvzcijdk.log
- C:\mschainserverruntime\56085415360792
- %HOMEPATH%\desktop\tetssmjr.log
- %HOMEPATH%\desktop\mtpwtsqp.log
- C:\mschainserverruntime\lsbhyg4g8tgjrle.vbe
- C:\mschainserverruntime\w7njgelmebhtbvgxgojjf.bat
- %HOMEPATH%\desktop\baamaada.log
- %HOMEPATH%\desktop\byutsvrj.log
- %HOMEPATH%\desktop\aijyoghn.log
- %HOMEPATH%\desktop\jbttutby.log
- %HOMEPATH%\desktop\wsthhjgt.log
- %HOMEPATH%\desktop\aprwzwft.log
- %HOMEPATH%\desktop\orkixkzv.log
- %HOMEPATH%\desktop\rljgpcqm.log
- %HOMEPATH%\desktop\yjxgsrkb.log
- %HOMEPATH%\desktop\padqipft.log
- %HOMEPATH%\desktop\wyrqleai.log
- %HOMEPATH%\desktop\lzofxmke.log
- %HOMEPATH%\desktop\cqupokew.log
- %HOMEPATH%\desktop\avztklea.log
- %HOMEPATH%\desktop\nlqsqged.log
- nul
Deletes the following files
- %TEMP%\isjuswil.cmdline
- %TEMP%\isjuswil.out
- %TEMP%\isjuswil.0.cs
- %TEMP%\1ggfvowpuy
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\msChainServerRuntime\LsBhyG4G8TGjRLe.vbe"
- 'C:\mschainserverruntime\blockagentbrowserhostdll.exe'
- '%ProgramFiles%\java\jre1.8.0_45\lib\amd64\firefox.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\msChainServerRuntime\w7nJgELMEBhTBvGXgoJJF.bat" "' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\isjuswil.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\tn6Btq5xkK.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\msChainServerRuntime\w7nJgELMEBhTBvGXgoJJF.bat" "
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\tn6Btq5xkK.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'%WINDIR%\PolicyDefinitions\en-US\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%WINDIR%\PolicyDefinitions\en-US\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'%WINDIR%\PolicyDefinitions\en-US\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\msChainServerRuntime\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\msChainServerRuntime\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\msChainServerRuntime\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\Java\jre1.8.0_45\lib\amd64\firefox.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\isjuswil.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'C:\msChainServerRuntime\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\msChainServerRuntime\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'C:\msChainServerRuntime\firefox.exe'" /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
