Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\azureconnect
Creates the following files on removable media
- <Drive name for removable media>:\xdwdusb.exe
- <Drive name for removable media>:\nwfieldnotes1966.docx.lnk
- <Drive name for removable media>:\sdszfo.docx.lnk
- <Drive name for removable media>:\issi2013_template_for_posters.docx.lnk
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx.lnk
- <Drive name for removable media>:\dotnetfx45_full_setup.exe.lnk
- <Drive name for removable media>:\calc.exe.lnk
- <Drive name for removable media>:\sdkfailsafeemulator.cer.lnk
- <Drive name for removable media>:\wrar520.exe.lnk
- <Drive name for removable media>:\utorrent.exe.lnk
- <Drive name for removable media>:\chromesetup.exe.lnk
- <Drive name for removable media>:\browse.htm.lnk
- <Drive name for removable media>:\alert.htm.lnk
- <Drive name for removable media>:\iisstart.htm.lnk
- <Drive name for removable media>:\64bit_notes.htm.lnk
- <Drive name for removable media>:\holycrosschurchinstructions.docx.lnk
- <Drive name for removable media>:\adhd_and_obesity.docx.lnk
- <Drive name for removable media>:\lisp_success.doc.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.lnk
- <Drive name for removable media>:\hanni_umami_chapter.doc.lnk
- <Drive name for removable media>:\join.avi.lnk
- <Drive name for removable media>:\tileimage.bmp.lnk
- <Drive name for removable media>:\dial.bmp.lnk
- <Drive name for removable media>:\dialmap.bmp.lnk
- <Drive name for removable media>:\dashborder_96.bmp.lnk
- <Drive name for removable media>:\dashborder_144.bmp.lnk
- <Drive name for removable media>:\trivial-merge.htm.lnk
- <Drive name for removable media>:\notepad.exe.lnk
- <Drive name for removable media>:\dashborder_120.bmp.lnk
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.lnk
- <Drive name for removable media>:\contosoroot_1.cer.lnk
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.lnk
- <Drive name for removable media>:\cveuropeo.doc.lnk
- <Drive name for removable media>:\ovp25012015.doc.lnk
- <Drive name for removable media>:\applicantform_en.doc.lnk
- <Drive name for removable media>:\delete.avi.lnk
- <Drive name for removable media>:\contoso.cer.lnk
- <Drive name for removable media>:\alert.html.lnk
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Program Files\Microsoft\AzureConnect\AzureConnect.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AzureConnect.exe'
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\.exe
- %ALLUSERSPROFILE%\program files\microsoft\azureconnect\azureconnect.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\xdwdusb.exe
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"%ProgramF...
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "AzureConnect" /tr "%ALLUSERSPROFILE%\Program Files\Microsoft\AzureConnect\AzureConnect.exe"
- '<SYSTEM32>\taskeng.exe' {F2A67789-06DA-413E-9976-D4CA75AFF03D} S-1-5-21-3691498038-2086406363-2140527554-1000:kuoxrejmptv\user:Interactive:[1]
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Program Files\Microsoft\AzureConnect\AzureConnect.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AzureConnect.exe'' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "AzureConnect" /tr "%ALLUSERSPROFILE%\Program Files\Microsoft\AzureConnect\AzureConnect.exe"' (with hidden window)
