Trojan.KillProc.53378

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

file extensions

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\reg.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\YkgO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\bUMA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\rYwk.exe
%HOMEPATH%\gOEYMkgs\pcUG.exe
%HOMEPATH%\gOEYMkgs\TwMa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\Kkwe.exe
%HOMEPATH%\gOEYMkgs\rwok.exe
%HOMEPATH%\gOEYMkgs\SYQm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\MEgI.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\cwcu.exe
%HOMEPATH%\gOEYMkgs\LwEO.exe
%HOMEPATH%\gOEYMkgs\nAIA.exe
%HOMEPATH%\gOEYMkgs\xEYs.exe
%HOMEPATH%\gOEYMkgs\yIUk.exe
%HOMEPATH%\gOEYMkgs\sAso.exe
%HOMEPATH%\gOEYMkgs\cUsw.exe
%HOMEPATH%\gOEYMkgs\TYMW.exe
%HOMEPATH%\gOEYMkgs\pUom.exe
%HOMEPATH%\gOEYMkgs\osIK.exe
%HOMEPATH%\gOEYMkgs\wgoc.exe
%HOMEPATH%\gOEYMkgs\RooM.exe
%HOMEPATH%\gOEYMkgs\DgIw.exe
%HOMEPATH%\gOEYMkgs\acIE.exe
%HOMEPATH%\gOEYMkgs\uYEE.exe
%HOMEPATH%\gOEYMkgs\voUG.exe
%HOMEPATH%\gOEYMkgs\jAos.exe
<Current directory>\<File name>
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\EgYG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\qQom.exe
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%WINDIR%\pchealth\ERRORREP\UserDumps\ZgMYMIIE.exe.20170804-041414-00.mdmp
%TEMP%\WER7e15.dir00\ZgMYMIIE.exe.mdmp
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\iQES.exe
%HOMEPATH%\gOEYMkgs\FswM.exe
%HOMEPATH%\gOEYMkgs\zokG.exe
%HOMEPATH%\gOEYMkgs\sUAw.exe
%HOMEPATH%\gOEYMkgs\nMEg.exe
%HOMEPATH%\gOEYMkgs\fQkc.exe
%HOMEPATH%\gOEYMkgs\CYEE.exe
%HOMEPATH%\gOEYMkgs\IwwQ.exe
%HOMEPATH%\gOEYMkgs\bQYQ.exe
%HOMEPATH%\gOEYMkgs\mQsM.exe
%HOMEPATH%\gOEYMkgs\lIsY.exe
%HOMEPATH%\gOEYMkgs\GMgS.exe
%HOMEPATH%\gOEYMkgs\LgUS.exe
%HOMEPATH%\gOEYMkgs\wMgc.exe