Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\Windows Portable Devices\firefox.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles%\Windows Portable Devices\firefox.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe", "%ProgramFiles%\Windows Portabl...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"%WINDIR%\Cursors\sppsvc.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"%WINDIR%\Cursors\sppsvc.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"<Current directory>\sppsvc.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"<Current directory>\sppsvc.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\services.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\services.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\sppsvcs
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\sppsvc
- <SYSTEM32>\tasks\<File name>i
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\<File name>
Modifies file system
Creates the following files
- <Current directory>\5db1eb8b6f4206
- %TEMP%\d8isfqqvcs.bat
- %TEMP%\gdmm338qna
- %TEMP%\eaznqrkl.out
- %TEMP%\eaznqrkl.cmdline
- %TEMP%\eaznqrkl.0.cs
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\886983d96e3d3e
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\csrss.exe
- %ProgramFiles%\windows portable devices\0fc223bdacedc3
- %ProgramFiles%\windows portable devices\firefox.exe
- %WINDIR%\cursors\0a1fd5f707cd16
- %WINDIR%\cursors\sppsvc.exe
- <Current directory>\0a1fd5f707cd16
- <Current directory>\sppsvc.exe
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\c5b4cb5e9653cc
- %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\services.exe
- nul
- %HOMEPATH%\desktop\qgdojgtd.log
Deletes the following files
- %TEMP%\eaznqrkl.out
- %TEMP%\eaznqrkl.0.cs
- %TEMP%\eaznqrkl.cmdline
- %TEMP%\gdmm338qna
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
Connects to
- '88####cm.renyash.ru':80
TCP
HTTP POST requests
- http://88####cm.renyash.ru/externalImage.php
UDP
- DNS ASK 88####cm.renyash.ru
- 'localhost':123
Miscellaneous
Creates and executes the following
- '<Current directory>\sppsvc.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\d8isFqqVCS.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>i" /sc MINUTE /mo 9 /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>i" /sc MINUTE /mo 13 /tr "'<Full path to file>'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'<Current directory>\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'<Current directory>\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'<Current directory>\sppsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'%WINDIR%\Cursors\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'%WINDIR%\Cursors\sppsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\Windows Portable Devices\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\Windows Portable Devices\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\Windows Portable Devices\firefox.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\eaznqrkl.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'%WINDIR%\Cursors\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\eaznqrkl.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\d8isFqqVCS.bat"' (with hidden window)
