Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Silverlight.Configuration.exe' = '"%ALLUSERSPROFILE%\Usoris\LogsOld\Silverlight.Configuration.exe"'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WUDFHostController] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WUDFHostController] 'ImagePath' = '<SYSTEM32>\svchost.exe -k "WUDFHostController" -svcr "WUDFHost.exe"'
- [HKLM\SYSTEM\CurrentControlSet\Services\WUDFHostController\Parameters] 'ServiceDLL' = '%ALLUSERSPROFILE%\Usoris\LogsOld\msimg32.dll'
- [HKLM\SYSTEM\CurrentControlSet\Services\WUDFHostController\Parameters] 'ImagePath' = '<SYSTEM32>\svchost.exe -k "WUDFHostController" -svcr "WUDFHost.exe"'
Creates the following services
- 'WUDFHostController' <SYSTEM32>\svchost.exe -k "WUDFHostController" -svcr "WUDFHost.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Add-MpPreference -ExclusionPath "%ALLUSERSPROFILE%\Usoris\LogsOld"
Modifies file system
Creates the following files
- %TEMP%\is-bjq8o.tmp\<File name>.tmp
- %TEMP%\is-92406.tmp\_isetup\_setup64.tmp
- %TEMP%\is-92406.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8tf07.tmp\<File name>.tmp
- %TEMP%\is-pihsf.tmp\_isetup\_setup64.tmp
- %TEMP%\is-pihsf.tmp\_isetup\_shfoldr.dll
- %ALLUSERSPROFILE%\usoris\logsold\is-scdg0.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-f640u.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-knr1t.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-cqm3u.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-c1d0d.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-fnl9u.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-dhk1r.tmp
- %ALLUSERSPROFILE%\usoris\logsold\is-sp02k.tmp
Deletes the following files
- %TEMP%\is-bjq8o.tmp\<File name>.tmp
- %TEMP%\is-pihsf.tmp\_isetup\_setup64.tmp
- %TEMP%\is-pihsf.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8tf07.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\usoris\logsold\msimg32.dll.bak
Moves the following files
- from %ALLUSERSPROFILE%\usoris\logsold\is-scdg0.tmp to %ALLUSERSPROFILE%\usoris\logsold\libeay32.dll
- from %ALLUSERSPROFILE%\usoris\logsold\is-f640u.tmp to %ALLUSERSPROFILE%\usoris\logsold\msimg32.dll
- from %ALLUSERSPROFILE%\usoris\logsold\is-knr1t.tmp to %ALLUSERSPROFILE%\usoris\logsold\settings.dat
- from %ALLUSERSPROFILE%\usoris\logsold\is-cqm3u.tmp to %ALLUSERSPROFILE%\usoris\logsold\silverlight.configuration.exe
- from %ALLUSERSPROFILE%\usoris\logsold\is-c1d0d.tmp to %ALLUSERSPROFILE%\usoris\logsold\ssleay32.dll
- from %ALLUSERSPROFILE%\usoris\logsold\is-fnl9u.tmp to %ALLUSERSPROFILE%\usoris\logsold\w32.dat
- from %ALLUSERSPROFILE%\usoris\logsold\is-dhk1r.tmp to %ALLUSERSPROFILE%\usoris\logsold\w64.dat
- from %ALLUSERSPROFILE%\usoris\logsold\is-sp02k.tmp to %ALLUSERSPROFILE%\usoris\logsold\wudfhost.exe
- from %ALLUSERSPROFILE%\usoris\logsold\msimg32.dll to %ALLUSERSPROFILE%\usoris\logsold\msimg32.dll.bak
Substitutes the following files
- %ALLUSERSPROFILE%\usoris\logsold\msimg32.dll
Network activity
Connects to
- 'localhost':5660
- 'id##.###oteutilities.com':443
- '17#.#6.123.220':80
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
UDP
- DNS ASK id##.###oteutilities.com
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '%TEMP%\is-bjq8o.tmp\<File name>.tmp' /SL5="$60248,7084604,56832,<Full path to file>"
- '%TEMP%\is-8tf07.tmp\<File name>.tmp' /SL5="$70182,7084604,56832,<Full path to file>" /VERYSILENT
- '%ALLUSERSPROFILE%\usoris\logsold\silverlight.configuration.exe' f
- '%ALLUSERSPROFILE%\usoris\logsold\wudfhost.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\svchost.exe' -k "WUDFHostController" -svcr "WUDFHost.exe"
- '%WINDIR%\syswow64\cmd.exe' /c powershell.exe -command Add-MpPreference -ExclusionPath "%ALLUSERSPROFILE%\Usoris\LogsOld"
- '<Full path to file>' /VERYSILENT' (with hidden window)
- '%ALLUSERSPROFILE%\usoris\logsold\silverlight.configuration.exe' f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c powershell.exe -command Add-MpPreference -ExclusionPath "%ALLUSERSPROFILE%\Usoris\LogsOld"' (with hidden window)
