Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '175a36c' = 'mshta javascript:VoW3fDg2="4z9r3Le";X3G3=new%20ActiveXObject("WScript.Shell");IjaF2z4W="dNbPrc";PH1D3W=X3G3.RegRead...
- [HKLM\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '988797e' = 'mshta javascript:iw1y0icYb="DzkzkQe3";x6W=new%20ActiveXObject("WScript.Shell");vSEv8fl8q="01TRWo...
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '175a36c' = 'mshta javascript:pbU9TBS="0sMZNA";i40Y=new%20ActiveXObject("WScript.Shell");eTTsOH5M="k";S7nbK=i40Y.RegRead("HKCU\\software\\8c...
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\regsvr32.exe
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
Modifies file system
Deletes itself.
Network activity
Connects to
- '62.##.228.193':8080
- '18.##0.173.227':80
- '80.##0.150.32':80
- '24#.#45.28.170':80
- '10#.#10.6.156':8080
- '21#.#74.167.145':80
- '16#.#95.214.188':80
- '73.##.169.182':80
- '23#.#1.187.193':80
- '31.##2.97.143':80
- '19#.#2.59.97':80
- '14#.#9.213.180':443
- '13#.#45.203.19':80
- '22#.#2.253.161':80
- '46.##.126.163':80
- '98.##8.250.8':80
- '19#.#28.190.123':80
- '86.##.47.185':8080
- '31.##3.105.224':80
- '31.##7.235.170':80
- '90.##3.242.228':80
- '24#.#87.250.4':80
- '81.##.117.255':80
- '59.##4.97.47':80
- '36.##5.173.33':8080
- '17#.#82.144.183':80
- '11#.#6.26.50':80
- '28.##8.86.68':80
- '18#.#54.187.192':80
- '12#.#97.46.197':80
- '55.##9.66.162':443
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\mshta.exe' javascript:LsgFVyF7x4="fHvGPJmA";eK95=new%20ActiveXObject("WScript.Shell");PhbBpgk4="rWW";sqx58O=eK95.RegRead("HKLM\\software\\Wow6432Node\\YTTTqek\\wEOT01e7P0");xW7K8SxN="RSY8z";eval(sqx58O);h...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' iex $env:vptiz
- '%WINDIR%\syswow64\regsvr32.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' iex $env:vptiz' (with hidden window)
