Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\taskserror.dat
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\3FTG0pFyIinCCY36] 'ImagePath' = '%WINDIR%\Tasks\taskserror.dat'
- [HKLM\SYSTEM\CurrentControlSet\Services\Ncasvc32] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Ncasvc32] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalServiceNetworkRestricted'
- [HKLM\SYSTEM\CurrentControlSet\Services\Ncasvc32\Parameters] 'ServiceDll' = '%ALLUSERSPROFILE%\Microsoft\NetFramework\Downloader\mpasbase.rdp'
Creates the following services
- '3FTG0pFyIinCCY36' %WINDIR%\Tasks\taskserror.dat
- 'Ncasvc32' <SYSTEM32>\svchost.exe -k LocalServiceNetworkRestricted
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /FI "SERVICES eq EventLog"
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
- nul
Deletes the following system files
- <SYSTEM32>\winevt\logs\microsoft-windows-ntfs%4operational.evtx
- <SYSTEM32>\winevt\logs\microsoft-windows-ntfs%4whc.evtx
Deletes following files that it created itself
- %WINDIR%\tasks\taskserror.dat
Moves the following system files
- from <SYSTEM32>\werfault.exe to <SYSTEM32>\werfault.exe.bak
- from %WINDIR%\syswow64\werfault.exe to %WINDIR%\syswow64\werfault.exe.bak
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /F /FI "SERVICES eq EventLog"
- '<SYSTEM32>\auditpol.exe' /set /category:* /success:disable /failure:disable
- '<SYSTEM32>\sc.exe' create Ncasvc32 binPath= "<SYSTEM32>\svchost.exe -k LocalServiceNetworkRestricted" type= share start= auto
- '<SYSTEM32>\cmd.exe' /c wmic recoveros set WriteDebugInfo=FALSE >nul 2>&1
- '<SYSTEM32>\wbem\wmic.exe' recoveros set WriteDebugInfo=FALSE
- '<SYSTEM32>\auditpol.exe' /set /category:* /success:disable /failure:disable' (with hidden window)
- '<SYSTEM32>\sc.exe' create Ncasvc32 binPath= "<SYSTEM32>\svchost.exe -k LocalServiceNetworkRestricted" type= share start= auto' (with hidden window)
