Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Modifies file system
Creates the following files
- C:\microsoftupdater\microsoftupdate.exe
- C:\users\default user\spoolsv.exe
- C:\users\default user\f3b6ecef712a24
- C:\kms\idle.exe
- C:\kms\6ccacd8608530f
- %TEMP%\ehlj5sacoe
- %TEMP%\cdwbaqvcz8.bat
- nul
- %HOMEPATH%\desktop\fgwelzoo.log
- %HOMEPATH%\desktop\irglkwuh.log
- %HOMEPATH%\desktop\znywbdea.log
- %HOMEPATH%\desktop\qufmnuew.log
- %HOMEPATH%\desktop\xhegtzjh.log
- %HOMEPATH%\desktop\vxiftgeg.log
- %HOMEPATH%\desktop\dlgaakjs.log
- %HOMEPATH%\desktop\uhxkqrtk.log
- %HOMEPATH%\desktop\cvwfwvyv.log
- %HOMEPATH%\desktop\tmcpmtto.log
- %HOMEPATH%\desktop\aaaktxyz.log
- %HOMEPATH%\desktop\akqppioc.log
- %HOMEPATH%\desktop\zugumsdg.log
- %HOMEPATH%\desktop\qqxecznz.log
- C:\microsoftupdater\9db6e019d4f04e
- %HOMEPATH%\desktop\inppsgys.log
- C:\microsoftupdater\iexplore.exe
- C:\microsoftupdater\system.exe
- C:\microsoftupdater\mrwtdwkboxwid2z9suoldnypro0cg8z.vbe
- C:\microsoftupdater\ehgewl7wdkvtzgn.bat
- %HOMEPATH%\desktop\ewhhkldl.log
- %HOMEPATH%\desktop\mluiqvjo.log
- %HOMEPATH%\desktop\ssxnputh.log
- %HOMEPATH%\desktop\phsxihio.log
- %HOMEPATH%\desktop\wqfrocxz.log
- %HOMEPATH%\desktop\omxceiis.log
- %HOMEPATH%\desktop\wfgxlwcd.log
- %HOMEPATH%\desktop\vavwlnnd.log
- %HOMEPATH%\desktop\dotrrrso.log
- %HOMEPATH%\desktop\vklbhxcg.log
- %HOMEPATH%\desktop\cyjwnchr.log
- %HOMEPATH%\desktop\klhqugmc.log
- %HOMEPATH%\desktop\bsoggxmz.log
- %HOMEPATH%\desktop\andggoxz.log
- %HOMEPATH%\desktop\rjvqwvhr.log
- %HOMEPATH%\desktop\zxtldzmc.log
- C:\microsoftupdater\901c4639deffed
- C:\kms\iexplore.exe
- C:\kms\9db6e019d4f04e
- C:\microsoftupdater\27d1bcfc3c54e0
- %HOMEPATH%\desktop\ovcjybnc.log
Deletes the following files
- %TEMP%\ehlj5sacoe
Network activity
Connects to
- 'lo####.#harlyworld.space':80
TCP
HTTP POST requests
- http://lo####.#harlyworld.space/packetGamepublic.php
UDP
- DNS ASK lo####.#harlyworld.space
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\MicrosoftUpdater\mrWtDwKBoxwid2z9sUOlDNyPrO0cG8Z.vbe"
- 'C:\microsoftupdater\microsoftupdate.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\MicrosoftUpdater\eHgEWL7WdKVTzgn.bat" "
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\CDWbAqVCz8.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\MicrosoftUpdater\eHgEWL7WdKVTzgn.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\CDWbAqVCz8.bat"' (with hidden window)
