BackDoor.DarkCrystal.227

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\taskhostt
<SYSTEM32>\tasks\taskhost
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\wudfhostw
<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\winlogon

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Modifies file system

Creates the following files

%APPDATA%\portproviderruntimebroker\reviewsvc.exe
%HOMEPATH%\desktop\yrlakmsw.log
%HOMEPATH%\desktop\gtkankdl.log
%HOMEPATH%\desktop\eypfjlco.log
%HOMEPATH%\desktop\nryaqzxa.log
%HOMEPATH%\desktop\cnjocysv.log
%ProgramFiles%\windows mail\en-us\taskhost.exe
%ProgramFiles%\windows mail\en-us\b75386f1303e64
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\886983d96e3d3e
%TEMP%\ecziovilkq.bat
%WINDIR%\globalization\mct\mct-ca\rssfeed\wudfhost.exe
%WINDIR%\globalization\mct\mct-ca\rssfeed\480b7989c529f6
%ProgramFiles%\microsoft office\csrss.exe
%ProgramFiles%\microsoft office\886983d96e3d3e
%ProgramFiles(x86)%\windows nt\accessories\en-us\winlogon.exe
%ProgramFiles(x86)%\windows nt\accessories\en-us\cc11b995f2a76d
%TEMP%\4uhz6gkrxt
%HOMEPATH%\desktop\dxllvxdl.log
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\csrss.exe
%HOMEPATH%\desktop\wzymsjjw.log
%HOMEPATH%\desktop\qjgxqslz.log
%APPDATA%\portproviderruntimebroker\dbjr4qdm6vxkp5nzsefrgnxblvuqkzue65cvb2cag29lqpnuk00ra.vbe
%APPDATA%\portproviderruntimebroker\kcvr2xgvpr26ezduvsf771.bat
%HOMEPATH%\desktop\jikfuftf.log
%HOMEPATH%\desktop\lrmnuhmc.log
%HOMEPATH%\desktop\ukwiauho.log
%HOMEPATH%\desktop\soamxwgr.log
%HOMEPATH%\desktop\glmbjvbn.log
%HOMEPATH%\desktop\onlbmtlc.log
%HOMEPATH%\desktop\thbitkuf.log
%HOMEPATH%\desktop\dzxvvmlc.log
%HOMEPATH%\desktop\jravysqr.log
%HOMEPATH%\desktop\grtzulau.log
%HOMEPATH%\desktop\ofstbpff.log
%HOMEPATH%\desktop\wirudnpu.log
%HOMEPATH%\desktop\neieuuzn.log
%HOMEPATH%\desktop\leciqmkq.log
%HOMEPATH%\desktop\gybxfaza.log
nul

Deletes the following files

%TEMP%\4uhz6gkrxt

Network activity

UDP

'localhost':123

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\portproviderruntimeBroker\dBjR4QDM6VxKP5NZSefrGNxbLvuQkzUe65CvB2Cag29LQPNUK00Ra.vbe"
'%APPDATA%\portproviderruntimebroker\reviewsvc.exe'
'%ProgramFiles%\microsoft office\csrss.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\portproviderruntimeBroker\KcVR2XgvPr26EzDuvsF771.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /C "%TEMP%\eCzIoVilKq.bat"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\portproviderruntimeBroker\KcVR2XgvPr26EzDuvsF771.bat" "
'<SYSTEM32>\cmd.exe' /C "%TEMP%\eCzIoVilKq.bat"
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Windows NT\Accessories\en-US\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\Microsoft Office\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles%\Microsoft Office\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\Microsoft Office\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'%WINDIR%\Globalization\MCT\MCT-CA\RSSFeed\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%WINDIR%\Globalization\MCT\MCT-CA\RSSFeed\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'%WINDIR%\Globalization\MCT\MCT-CA\RSSFeed\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\Windows Mail\en-US\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%ProgramFiles%\Windows Mail\en-US\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\Windows Mail\en-US\taskhost.exe'" /f
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2