Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%HOMEPATH%\Documents\MSDCSC\msdcsc.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\Documents\MSDCSC\msdcsc.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\javaupdate
- <SYSTEM32>\tasks\adobe flash player
- <SYSTEM32>\tasks\lsass.exe
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\WindowsInput] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WindowsInput] 'ImagePath' = '"%WINDIR%\SysWOW64\WindowsInput.exe"'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\quasar.exe
- %APPDATA%\explorer.exe.config
- %APPDATA%\explorer.exe
- %WINDIR%\syswow64\windowsinput.installstate
- %WINDIR%\syswow64\windowsinput.exe.config
- %WINDIR%\syswow64\windowsinput.exe
- %TEMP%\ymk8zd_4.dll
- %TEMP%\resb578.tmp
- %APPDATA%\svchost.exe
- %TEMP%\cscb577.tmp
- %TEMP%\ymk8zd_4.cmdline
- %TEMP%\ymk8zd_4.0.cs
- %TEMP%\bciharbmrcjx.exe
- %HOMEPATH%\documents\msdcsc\msdcsc.exe
- %TEMP%\iha9tkdoqcet.exe
- %APPDATA%\logs\05-12-2020
- %APPDATA%\java\javaupdate.exe
- %TEMP%\ymk8zd_4.out
- %APPDATA%\svchost.exe.config
Sets the 'hidden' attribute to the following files
- %APPDATA%\java\javaupdate.exe
- %HOMEPATH%\documents\msdcsc\msdcsc.exe
- %APPDATA%\explorer.exe
Deletes the following files
- %TEMP%\iha9tkdoqcet.exe
- %TEMP%\resb578.tmp
- %TEMP%\cscb577.tmp
- %TEMP%\ymk8zd_4.out
- %TEMP%\ymk8zd_4.cmdline
- %TEMP%\ymk8zd_4.0.cs
- %TEMP%\ymk8zd_4.dll
Network activity
TCP
HTTP GET requests
- http://ip##pi.com/json/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ip##pi.com
- DNS ASK ra####ts.ddns.net
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'Program Manager'
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\quasar.exe'
- '%APPDATA%\java\javaupdate.exe'
- '%TEMP%\iha9tkdoqcet.exe'
- '%HOMEPATH%\documents\msdcsc\msdcsc.exe'
- '%TEMP%\bciharbmrcjx.exe'
- '%WINDIR%\syswow64\windowsinput.exe' --install
- '%WINDIR%\syswow64\windowsinput.exe'
- '%APPDATA%\explorer.exe'
- '%APPDATA%\svchost.exe' /launchSelfAndExit "%APPDATA%\explorer.exe" 2296 /protectFile
- '%APPDATA%\svchost.exe' /watchProcess "%APPDATA%\explorer.exe" 2296 "/protectFile"
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%TEMP%\IhA9TkDOqcET.exe" +s +h' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%LOCALAPPDATA%\Temp" +s +h' (with hidden window)
- '%WINDIR%\syswow64\notepad.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ymk8zd_4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB578.tmp" "%TEMP%\CSCB577.tmp"' (with hidden window)
- '%APPDATA%\explorer.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "JavaUpdate" /sc ONLOGON /tr "%TEMP%\Quasar.exe" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "JavaUpdate" /sc ONLOGON /tr "%APPDATA%\Java\JavaUpdate.exe" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%TEMP%\IhA9TkDOqcET.exe" +s +h
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%LOCALAPPDATA%\Temp" +s +h
- '%WINDIR%\syswow64\notepad.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%WINDIR%\syswow64\attrib.exe' "%TEMP%\IhA9TkDOqcET.exe" +s +h
- '%WINDIR%\syswow64\attrib.exe' "%LOCALAPPDATA%\Temp" +s +h
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ymk8zd_4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB578.tmp" "%TEMP%\CSCB577.tmp"
- '<SYSTEM32>\taskeng.exe' {15EB24E4-442D-4C38-8F76-EBD48C902527} S-1-5-21-1960123792-2022915161-3775307078-1001:ciiadlmdvd\user:Interactive:[1]
