Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
Modifies file system
Creates the following files
- C:\webwinbrokerdll\bridgeserverruntime.exe
- %TEMP%\ipcguei3.0.cs
- %ProgramFiles(x86)%\windows nt\accessories\en-us\480b7989c529f6
- %ProgramFiles(x86)%\windows nt\accessories\en-us\wudfhost.exe
- <Current directory>\c5b4cb5e9653cc
- <Current directory>\services.exe
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\c5b4cb5e9653cc
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\services.exe
- C:\kms\27d1bcfc3c54e0
- C:\kms\system.exe
- C:\users\public\favorites\101b941d020240
- C:\users\public\favorites\lsm.exe
- C:\webwinbrokerdll\1737a4c97c6fbd
- %HOMEPATH%\desktop\hcvxkiln.log
- %HOMEPATH%\desktop\umeyenmj.log
- %HOMEPATH%\desktop\mllrkuol.log
- C:\webwinbrokerdll\oh5mseg2kerkhqjt.bat
- C:\webwinbrokerdll\d7vv42fphwmzbqmszwm0qgomzi6nsu6x6fwca17sifxi7shnedkycwqtfx6.vbe
- %TEMP%\ipcguei3.cmdline
- %TEMP%\ipcguei3.out
Deletes the following files
- %TEMP%\ipcguei3.out
- %TEMP%\ipcguei3.cmdline
- %TEMP%\ipcguei3.0.cs
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
Connects to
- '34.##9.100.209':443
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\WebWinBrokerDll\d7VV42fpHwMzBQMSzwM0QGomZi6nsu6X6fwca17SIFxI7SHNedkYCWqtFx6.vbe"
- 'C:\webwinbrokerdll\bridgeserverruntime.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\WebWinBrokerDll\OH5MsEg2KeRkhqJt.bat" "
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\MdgpWgb4BE.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "BridgeServerruntimeB" /sc MINUTE /mo 13 /tr "'C:\WebWinBrokerDll\BridgeServerruntime.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "BridgeServerruntime" /sc ONLOGON /tr "'C:\WebWinBrokerDll\BridgeServerruntime.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "BridgeServerruntimeB" /sc MINUTE /mo 8 /tr "'C:\WebWinBrokerDll\BridgeServerruntime.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Favorites\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Favorites\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Favorites\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\kms\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\kms\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\kms\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<Current directory>\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 8 /tr "'<Current directory>\services.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ipcguei3.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Windows NT\Accessories\en-US\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows NT\Accessories\en-US\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Windows NT\Accessories\en-US\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\services.exe'" /rl HIGHEST /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ipcguei3.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\WebWinBrokerDll\OH5MsEg2KeRkhqJt.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\MdgpWgb4BE.bat"' (with hidden window)
