Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\svctcom] 'ImagePath' = '<SYSTEM32>\svctcom.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\svctcom] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\svctcom.exe' = '<SYSTEM32>\svctcom.exe:*:Enabled:ActivTrak ...
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding DCA129765F7D548EC9A7ADDBC0A3A0F9 M Global\MSI0000
- '<SYSTEM32>\svctcom.exe'
- '<SYSTEM32>\scthost.exe'
- '<SYSTEM32>\msiexec.exe' /i "codec mp4.msi" ALLUSERS=1 /qn /norestart /log output.log
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 05465E15D9714D57A4858186D9B1598C
Modifies file system:
Creates the following files:
- <SYSTEM32>\svctcom.exe
- <SYSTEM32>\scthost.exe
- <SYSTEM32>\conmhost.exe
- <SYSTEM32>\conmhost.json
- %TEMP%\Cab19.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab15.tmp
- <SYSTEM32>\GroupPolicy\Machine\Registry.pol
- <SYSTEM32>\GroupPolicy\gpt.ini
- %ALLUSERSPROFILE%\ntuser.pol
- %TEMP%\~DFE6AE.tmp
- %WINDIR%\Installer\MSI1C.tmp
- %WINDIR%\Installer\MSI1B.tmp
- <SYSTEM32>\scthosth.dll
- <SYSTEM32>\aamdata\2016_12.log
- %WINDIR%\Installer\1fffa.msi
- %TEMP%\CabF.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab3.tmp
- %TEMP%\Cab1.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\RarSFX0\output.log
- %TEMP%\RarSFX0\codec mp4.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %WINDIR%\Installer\1fff6.msi
- %WINDIR%\Installer\MSIC.tmp
- %TEMP%\~DFCA5A.tmp
- C:\Config.Msi\1fff9.rbs
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\1fff8.ipi
- %TEMP%\Cab7.tmp
- %TEMP%\Cab5.tmp
- %WINDIR%\Installer\MSIB.tmp
- %TEMP%\Cab9.tmp
Deletes the following files:
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI1C.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\RarSFX0\codec mp4.msi
- %TEMP%\RarSFX0\output.log
- %WINDIR%\Installer\1fff8.ipi
- C:\Config.Msi\1fff9.rbs
- %WINDIR%\Installer\1fff6.msi
- %TEMP%\Cab15.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\CabF.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSID.tmp
Network activity:
Connects to:
- 'cr#.##modoca.com':80
- 'ba#####.activtrak.net':443
- 'wp#d':80
- 'www.download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://cr#.##modoca.com/COMODORSAAddTrustCA.crt
- http://cr#.##modoca.com/COMODORSACodeSigningCA.crt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK cr#.##modoca.com
- DNS ASK ba#####.activtrak.net
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'AAM_MONITOR' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
