Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\eyzsuusuw
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\69577.exe'
Modifies file system
Creates the following files
- C:\users\public\69577.exe
- %TEMP%\eyzsuusuw.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\myt8duv9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xx4cbxk8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\amb9x10r\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\byxpbag1\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\myt8duv9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xx4cbxk8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\amb9x10r\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\byxpbag1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Moves the following files
- from %TEMP%\eyzsuusuw.exe to %TEMP%\eyzsuusuw.exe
Network activity
Connects to
- 'i-#.xyz':80
- 'pa##e.ee':443
- 'oc##.#tartssl.com':80
TCP
- 'pa##e.ee':443
UDP
- DNS ASK i-#.xyz
- DNS ASK pa##e.ee
- DNS ASK oc##.#tartssl.com
Miscellaneous
Creates and executes the following
- '%TEMP%\eyzsuusuw.exe'
- '%TEMP%\eyzsuusuw.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass %TEMP%\JZPlrcapQ.ps1' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\schtasks.exe' /create /tn EYzsUUSUW /tr %TEMP%\EYzsUUSUW.exe /sc minute /mo 1 /F
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\taskeng.exe' {93A51636-DE3A-4EAC-ABA2-4DC8DCABA98F} S-1-5-21-1960123792-2022915161-3775307078-1001:vbqwbqst\user:Interactive:[1]
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass %TEMP%\JZPlrcapQ.ps1
