Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\352a79fa-dc5d-4ba1-8e44-f7639fd874b0\2FC6.exe" --AutoStart'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent f5e1525742421d51
- <SYSTEM32>\tasks\yiueea.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\wjfvdvg
- %TEMP%\b885.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %LOCALAPPDATA%\352a79fa-dc5d-4ba1-8e44-f7639fd874b0\2fc6.exe
- %TEMP%\a894.exe
- %TEMP%\577f58beff\yiueea.exe
- %TEMP%\5fe0.exe
- %TEMP%\4a4c.exe
- %TEMP%\46a3.exe
- %TEMP%\4174.dll
- %TEMP%\37a4.exe
- %TEMP%\2fc6.exe
- %APPDATA%\wfvbfcf
- %TEMP%\b885.tmp-shm
- %TEMP%\edec.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\wjfvdvg
- %APPDATA%\wfvbfcf
Deletes the following files
- %TEMP%\b885.tmp-shm
- %TEMP%\b885.tmp
- %TEMP%\edec.tmp-shm
Deletes itself.
Network activity
Connects to
- 'su####lituyo.org':80
- 'sn####ukeutit.org':80
- 'li#####insteniki.org':80
- 'li####oumumy.org':80
- 'st#####luyastrelia.net':80
- 'ap#.2ip.ua':443
- 'pk#.goog':80
- '79.##7.192.18':80
- 'al###adcare.com':443
- 'mo####eyclub.org':443
- 'lo###erry.org':443
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
- http://79.##7.192.18/newmar.exe
HTTP POST requests
- http://su####lituyo.org/
- http://sn####ukeutit.org/
- http://li#####insteniki.org/
- http://li####oumumy.org/
- http://79.##7.192.18/9bDc8sQ/index.php
- http://st#####luyastrelia.net/
Other
- 'ap#.2ip.ua':443
- 'al###adcare.com':443
- 'mo####eyclub.org':443
- 'lo###erry.org':443
UDP
- DNS ASK on###ituyrs.org
- DNS ASK su####lituyo.org
- DNS ASK sn####ukeutit.org
- DNS ASK li#####insteniki.org
- DNS ASK li####oumumy.org
- DNS ASK st#####luyastrelia.net
- DNS ASK ap#.2ip.ua
- DNS ASK pk#.goog
- DNS ASK al###adcare.com
- DNS ASK mo####eyclub.org
- DNS ASK lo###erry.org
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\2fc6.exe'
- '%TEMP%\37a4.exe'
- '%TEMP%\46a3.exe'
- '%TEMP%\4a4c.exe'
- '%TEMP%\5fe0.exe'
- '%TEMP%\577f58beff\yiueea.exe'
- '%TEMP%\a894.exe'
- '%TEMP%\2fc6.exe' --Admin IsNotAutoStart IsNotTask
- '%TEMP%\577f58beff\yiueea.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "%TEMP%\577f58beff\yiueea.exe" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\352a79fa-dc5d-4ba1-8e44-f7639fd874b0" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\4174.dll
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "%TEMP%\577f58beff\yiueea.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "yiueea.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "yiueea.exe" /P "user:R" /E
- '<SYSTEM32>\taskeng.exe' {D8C4DAB2-45EC-4D4E-988B-ED12EA288E42} S-1-5-21-3150914307-1777937420-491476919-1000:zvzxwnhpfz\user:Interactive:[1]
- '%WINDIR%\syswow64\cacls.exe' "..\577f58beff" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "..\577f58beff" /P "user:R" /E
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\352a79fa-dc5d-4ba1-8e44-f7639fd874b0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
