Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"<SYSTEM32>\C_28593\spoolsv.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<SYSTEM32>\winrm\taskhost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"<SYSTEM32>\sfc\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\Far2\FExcept\System.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\Documents and Settings\spoolsv.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\totalcmd\LANGUAGE\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\PerfLogs\Admin\Idle.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\idle
Creates the following files on removable media
- <Drive name for removable media>:\0bb452fdad3ce13d0f033a6538fcf20f.exe
- <Drive name for removable media>:\applicantform_en.lnk
- <Drive name for removable media>:\lisp_success.lnk
- <Drive name for removable media>:\february_catalogue__2015.lnk
- <Drive name for removable media>:\contoso.lnk
- <Drive name for removable media>:\sdksampleprivdeveloper.lnk
- <Drive name for removable media>:\sdksampleunprivdeveloper.lnk
- <Drive name for removable media>:\contosoroot.lnk
- <Drive name for removable media>:\pmd.lnk
- <Drive name for removable media>:\dial.lnk
- <Drive name for removable media>:\tileimage.lnk
- <Drive name for removable media>:\dashborder_96.lnk
- <Drive name for removable media>:\dashborder_192.lnk
- <Drive name for removable media>:\dialmap.lnk
- <Drive name for removable media>:\coffee.lnk
- <Drive name for removable media>:\toolbar.lnk
- <Drive name for removable media>:\join.lnk
- <Drive name for removable media>:\split.lnk
- <Drive name for removable media>:\archer.lnk
- <Drive name for removable media>:\000814251_video_01.lnk
- <Drive name for removable media>:\ovp25012015.lnk
- <Drive name for removable media>:\508softwareandos.lnk
Modifies file system
Creates the following files
- <SYSTEM32>\c_28593\spoolsv.exe
- %TEMP%\ke9ve4muol
- C:\perflogs\admin\6ccacd8608530f
- C:\perflogs\admin\idle.exe
- C:\totalcmd\language\9db6e019d4f04e
- C:\totalcmd\language\iexplore.exe
- C:\documents and settings\f3b6ecef712a24
- %TEMP%\rg4imtcfwu.bat
- C:\documents and settings\spoolsv.exe
- C:\far2\fexcept\system.exe
- <SYSTEM32>\sfc\480b7989c529f6
- <SYSTEM32>\sfc\wudfhost.exe
- <SYSTEM32>\winrm\b75386f1303e64
- <SYSTEM32>\winrm\taskhost.exe
- <SYSTEM32>\c_28593\f3b6ecef712a24
- C:\far2\fexcept\27d1bcfc3c54e0
- nul
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\0bb452fdad3ce13d0f033a6538fcf20f.exe
Deletes the following files
- %TEMP%\ke9ve4muol
Network activity
Connects to
- '18#.#20.229.5':80
TCP
HTTP GET requests
- http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?ek########################################################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<SYSTEM32>\C_28593\spoolsv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<SYSTEM32>\winrm\taskhost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\FExcept\System.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\Idle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<SYSTEM32>\sfc\WUDFHost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\iexplore.exe'
- 'C:\totalcmd\language\iexplore.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\rg4iMtCfWU.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<SYSTEM32>\C_28593\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<SYSTEM32>\winrm\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<SYSTEM32>\sfc\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Far2\FExcept\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Documents and Settings\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Admin\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\spoolsv.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\rg4iMtCfWU.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
