Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\browser.lnk
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following
- '' (downloaded from the Internet)
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im k4.exe
Injects code into
the following user processes:
- dllhosts.exe
Modifies file system
Creates the following files
- C:\users\public\documents\update.log
- %WINDIR%\temp\fwtsqmfile01.sqm
- %TEMP%\fnkrugh
- %TEMP%\aut58c9.tmp
- %TEMP%\cgscfhd
- %TEMP%\aut556f.tmp
- C:\users\public\documents\tasloginbase.dll
- %TEMP%\autaa23.tmp
- C:\users\public\documents\unzip.lnk
- C:\users\public\documents\unzip.exe
- C:\users\public\documents\sch.vbe
- C:\users\public\documents\k4.exe
- C:\users\public\documents\dllhosts.exe
- C:\users\public\documents\2022060125.vbe
- C:\users\public\documents\update.lnk
- C:\users\public\documents\unzip.dat
- %TEMP%\krkhvft
Deletes the following files
- %TEMP%\aut556f.tmp
- %TEMP%\cgscfhd
- %TEMP%\aut58c9.tmp
- %TEMP%\fnkrugh
- %TEMP%\autaa23.tmp
- %TEMP%\krkhvft
Network activity
Connects to
- 'de########.microsoftmiddlename.tk':80
- '27.##4.40.91':80
TCP
HTTP GET requests
- http://de########.microsoftmiddlename.tk/picturess/40.91.log
- http://de########.microsoftmiddlename.tk/picturess/13.txt
- http://de########.microsoftmiddlename.tk/picturess/uvb.jpg
- http://de########.microsoftmiddlename.tk/picturess/systems.exe
- http://de########.microsoftmiddlename.tk/picturess/IMG2022.jpg
- http://de########.microsoftmiddlename.tk/picturess/pig.jpg
- http://de########.microsoftmiddlename.tk/picturess/unzip.exe
- http://de########.microsoftmiddlename.tk/picturess/unzip.jpg
- http://de########.microsoftmiddlename.tk/picturess/unziplnk.jpg
- http://de########.microsoftmiddlename.tk/picturess/TASLoginBase5.dll
UDP
- DNS ASK de########.microsoftmiddlename.tk
- 'localhost':59726
- 'localhost':54271
- 'localhost':59098
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\users\public\documents\k4.exe'
- 'C:\users\public\documents\k4.exe' /D
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\Documents\sch.vbe"
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\Documents\2022060125.vbe"
- 'C:\users\public\documents\k4.exe' /E
- 'C:\users\public\documents\dllhosts.exe'
- 'C:\users\public\documents\unzip.exe' -o -P Startup8888 C:\Users\Public\Documents\unzip.dat -d "%APPDATA%"
- 'C:\users\public\documents\k4.exe' ' (with hidden window)
- 'C:\users\public\documents\k4.exe' /D' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /t /im k4.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\Documents\2022060125.vbe' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\Documents\sch.vbe"' (with hidden window)
- 'C:\users\public\documents\k4.exe' /E' (with hidden window)
- 'C:\users\public\documents\dllhosts.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /t /im k4.exe
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\Documents\2022060125.vbe
