Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\wudfhost
Modifies file system
Creates the following files
- C:\totalcmd\language\winlogon.exe
- <Current directory>\480b7989c529f6
- <Current directory>\wudfhost.exe
- C:\msocache\all users\69ddcba757bf72
- C:\msocache\all users\smss.exe
- <Current directory>\886983d96e3d3e
- <Current directory>\csrss.exe
- nul
- %TEMP%\87m84trvgj.bat
- %TEMP%\y8igm1hwzm
- %ProgramFiles%\submitfiles\559fba5f8e4410
- %ProgramFiles%\submitfiles\mdm.exe
- %WINDIR%\pchealth\errorrep\qheadles\24dbde2999530e
- %ProgramFiles%\pxagent\csrss.exe
- %WINDIR%\pchealth\errorrep\qheadles\wmiprvse.exe
- C:\users\default\application data\services.exe
- %ALLUSERSPROFILE%\documents\711e263b743a0e
- %ALLUSERSPROFILE%\documents\<File name>.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\886983d96e3d3e
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\24dbde2999530e
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\wmiprvse.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6cb0b6c459d5d3
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe
- %CommonProgramFiles%\system\en-us\42af1c969fbb7b
- %CommonProgramFiles%\system\en-us\audiodg.exe
- C:\totalcmd\language\cc11b995f2a76d
- C:\users\default\application data\c5b4cb5e9653cc
- %ProgramFiles%\pxagent\886983d96e3d3e
Deletes the following files
- %TEMP%\y8igm1hwzm
Network activity
Connects to
- '19#.#7.121.189':80
TCP
HTTP GET requests
- http://19#.#7.121.189/imagePrivate.php?2q########################################################################################################################################################...
- http://19#.#7.121.189/imagePrivate.php?oQ########################################################################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\msocache\all users\smss.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\87m84TRVGJ.bat"' (with hidden window)
- 'C:\msocache\all users\smss.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONSTART /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\SubmitFiles\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%ProgramFiles%\SubmitFiles\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONSTART /tr "'%ProgramFiles%\SubmitFiles\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\87m84TRVGJ.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 14 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONSTART /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 11 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\PXAgent\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc MINUTE /mo 9 /tr "'%WINDIR%\PCHEALTH\ERRORREP\QHEADLES\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles%\PXAgent\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONSTART /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 7 /tr "'%CommonProgramFiles%\System\en-US\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%CommonProgramFiles%\System\en-US\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONSTART /tr "'%CommonProgramFiles%\System\en-US\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc MINUTE /mo 13 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc MINUTE /mo 13 /tr "'%ALLUSERSPROFILE%\Documents\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Documents\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Documents\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'%ProgramFiles%\PXAgent\csrss.exe'" /rl HIGHEST /f
