Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\WUDFHost.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\WUDFHost.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe", "C:\MSOCache\All Users\{90140000-002C-0409-1000-00...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\WUDFHost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'
Modifies file system
Creates the following files
- %ProgramFiles%\java\jre1.8.0_45\lib\security\smss.exe
- %HOMEPATH%\desktop\zrvkbjox.log
- %HOMEPATH%\desktop\hvdalcee.log
- %HOMEPATH%\desktop\ilnvpsoa.log
- %HOMEPATH%\desktop\sjrfcjee.log
- %HOMEPATH%\desktop\uembgieb.log
- %HOMEPATH%\desktop\diuqqbui.log
- %HOMEPATH%\desktop\eyfltqee.log
- %HOMEPATH%\desktop\yvdrnefu.log
- %HOMEPATH%\desktop\hylhxyub.log
- %HOMEPATH%\desktop\itgcawuy.log
- %HOMEPATH%\desktop\rxpskpkf.log
- %HOMEPATH%\desktop\bwsdyhaj.log
- %HOMEPATH%\desktop\drnybfag.log
- %HOMEPATH%\desktop\ehytfvlc.log
- %HOMEPATH%\desktop\ybkpyudb.log
- %HOMEPATH%\desktop\nkgiooaj.log
- %HOMEPATH%\desktop\ixsibcvn.log
- nul
- %TEMP%\gqnlll25kv.bat
- %TEMP%\ty0obprjdy
- %TEMP%\unp22wua.out
- %TEMP%\unp22wua.cmdline
- %TEMP%\unp22wua.0.cs
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\0fc223bdacedc3
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe
- %ProgramFiles(x86)%\windows mail\en-us\886983d96e3d3e
- %ProgramFiles(x86)%\windows mail\en-us\csrss.exe
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\480b7989c529f6
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\wudfhost.exe
- %ProgramFiles%\java\jre1.8.0_45\lib\security\69ddcba757bf72
- %HOMEPATH%\desktop\pvmzwblc.log
- %HOMEPATH%\desktop\osrzoryt.log
Deletes the following files
- %TEMP%\unp22wua.0.cs
- %TEMP%\unp22wua.out
- %TEMP%\unp22wua.cmdline
- %TEMP%\ty0obprjdy
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
Connects to
- '17#.#7.68.115':80
TCP
HTTP POST requests
- http://17#.#7.68.115/4Provider/ServerUploadswpDatalife/6Request5Windows/5protectWordpress/Python3Db/processormultibetterJs/_HttpLongpoll6/7RequestDatalifePublic/WindowsPrivateSqlcentral/windows...
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\windows mail\en-us\csrss.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\GQnLLL25KV.bat"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\unp22wua.cmdline"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\GQnLLL25KV.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\unp22wua.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ProgramFiles%\Java\jre1.8.0_45\lib\security\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' -n 10 localhost
