Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\hrwfpdrv] 'ImagePath' = '<DRIVERS>\hrwfpdrv.sys'
- [<HKLM>\System\CurrentControlSet\Services\sysdiag] 'ImagePath' = '<DRIVERS>\sysdiag.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\sysdiag] 'ImagePath' = 'system32\DRIVERS\sysdiag.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\hrwfpdr] 'ImagePath' = 'system32\DRIVERS\hrwfpdrv.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\sysdiag] 'Start' = '00000001'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\hrwfpdr] 'Start' = '00000001'
Creates the following services
- 'hrwfpdrv' <DRIVERS>\hrwfpdrv.sys
- 'sysdiag' <DRIVERS>\sysdiag.sys
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\hrsword.bat
- <DRIVERS>\hrwfpdrv.sys
- <DRIVERS>\sysdiag.sys
- %TEMP%\7zipsfx.000\usysdiag.exe
- nul
- %TEMP%\7zipsfx.000\usysdiag.dll
- %TEMP%\7zipsfx.000\uactmon.dll
- %TEMP%\7zipsfx.000\libxsse.dll
- %WINDIR%\temp\udde208.tmp
- %TEMP%\7zipsfx.000\libcodecs.dll
- %TEMP%\7zipsfx.000\drivers\x64\usysdiag.exe
- %TEMP%\7zipsfx.000\drivers\x64\sysdiag.sys
- %TEMP%\7zipsfx.000\drivers\x64\hrwfpdrv.sys
- %TEMP%\7zipsfx.000\drivers\x32\usysdiag.exe
- %TEMP%\7zipsfx.000\drivers\x32\sysdiag.sys
- %TEMP%\7zipsfx.000\drivers\x32\hrwfpdrv.sys
- %TEMP%\7zipsfx.000\daemon.dll
- %TEMP%\7zipsfx.000\hrsword.exe
- %WINDIR%\temp\udde228.tmp
Deletes the following files
- %WINDIR%\temp\udde208.tmp
- %WINDIR%\temp\udde228.tmp
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\hrsword.exe'
- '%TEMP%\7zipsfx.000\usysdiag.exe' 288
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.000" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.000\HRSword.bat"' (with hidden window)
- '%TEMP%\7zipsfx.000\usysdiag.exe' 288' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c @pushd "%TEMP%\7ZipSfx.000" >nul 2>&1 & CALL "%TEMP%\7ZipSfx.000\HRSword.bat"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag\Instances\sysdiag" /f /v "Flags" /t reg_dword /d "0"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag\Instances\sysdiag" /f /v "Altitude" /d "324600"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag\Instances" /f /v "DefaultInstance" /d "sysdiag"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f /v "Group" /d "PNP_TDI"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\hrwfpdr" /f /v "Start" /t reg_dword /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f /v "Start" /t reg_dword /d "1"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\hrwfpdr" /f /v "ImagePath" /t REG_EXPAND_SZ /d "system32\DRIVERS\hrwfpdrv.sys"
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f /v "ImagePath" /t REG_EXPAND_SZ /d "system32\DRIVERS\sysdiag.sys"
- '<SYSTEM32>\sc.exe' create sysdiag binpath= "<DRIVERS>\sysdiag.sys" type= kernel start= demand error= normal depend= FltMgr group= "PNP_TDI"
- '<SYSTEM32>\sc.exe' create hrwfpdrv binpath= "<DRIVERS>\hrwfpdrv.sys" type= kernel start= demand error= normal
- '<SYSTEM32>\cmd.exe' /S /D /c" copy Drivers\x64\hrwfpdrv.sys "<DRIVERS>\" 1>NUL 2>NUL"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy Drivers\x64\sysdiag.sys "<DRIVERS>\" 1>NUL 2>NUL"
- '<SYSTEM32>\cmd.exe' /S /D /c" copy Drivers\x64\usysdiag.exe "%TEMP%\7ZipSfx.000\\" 1>NUL 2>NUL"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\reg.exe' QUERY "HKU\S-1-5-19"
- '<SYSTEM32>\sc.exe' start sysdiag
- '<SYSTEM32>\sc.exe' start hrwfpdrv
