Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_859752] 'ImagePath' = 'cmd /c C:\Users\Public\KK.exe'
- [HKLM\System\CurrentControlSet\Services\NAME01] 'ImagePath' = 'C:\rrv247Pbg.sys'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_891311] 'ImagePath' = 'cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f'
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_892715] 'ImagePath' = 'cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehav...
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_893979] 'ImagePath' = 'cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehav...
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_895258] 'ImagePath' = 'cmd /c rundll32.exe C:\Users\Public\svcer.dll,InsertSvc'
- [HKLM\System\CurrentControlSet\Services\Archer] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Archer] 'ImagePath' = '%WINDIR%\SysWOW64\svchost.exe -k ArcherGroupEx'
- [HKLM\SYSTEM\CurrentControlSet\Services\Archer\Parameters] 'ServiceDll' = 'C:\Users\Public\svcer.dll'
Creates the following services
- 'CreateSvcRpc_859752' cmd /c C:\Users\Public\KK.exe
- 'NAME01' C:\rrv247Pbg.sys
- 'CreateSvcRpc_891311' cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- 'CreateSvcRpc_892715' cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
- 'CreateSvcRpc_893979' cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
- 'CreateSvcRpc_895258' cmd /c rundll32.exe C:\Users\Public\svcer.dll,InsertSvc
- 'Archer' %WINDIR%\SysWOW64\svchost.exe -k ArcherGroupEx
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- C:\users\public\pro.exe
- C:\users\public\kk.exe
- %WINDIR%\temp\e_n60005\krnln.fnr
- %WINDIR%\temp\e_n60005\spec.fne
- %WINDIR%\temp\e_n60005\mp3.run
- C:\rrv247pbg.sys
- C:\users\public\svcer.dll
- %WINDIR%\temp\udd9e32.tmp
Deletes the following files
- %WINDIR%\temp\udd9e32.tmp
Network activity
Connects to
- '15#.#2.92.30':80
TCP
HTTP GET requests
- http://15#.#2.92.30/a8.217.251.181.txt
- http://15#.#2.92.30/s8.217.251.181.txt
- http://15#.#2.92.30/KK.TXT
Miscellaneous
Creates and executes the following
- 'C:\users\public\pro.exe'
- 'C:\users\public\kk.exe'
- 'C:\users\public\dzss.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c tasklist | findstr /i 360tray.exe
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /i 360tray.exe
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\KK.exe
- '<SYSTEM32>\cmd.exe' /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t reg_dword /d 0 /F
- '<SYSTEM32>\cmd.exe' /c rundll32.exe C:\Users\Public\svcer.dll,InsertSvc
- '<SYSTEM32>\rundll32.exe' C:\Users\Public\svcer.dll,InsertSvc
- '%WINDIR%\syswow64\svchost.exe' -k ArcherGroupEx
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v QQ°²È«ÖÐÐÄ /t REG_SZ /d "C:\Users\Public\dzss.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v QQ°²È«ÖÐÐÄ /t REG_SZ /d "C:\Users\Public\dzss.exe" /f
