Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Policy Reports Ordering' = 'C:\madjzuyo\z71iw9ddxfu.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto IKE Video Session Program Trap Encryption] 'ImagePath' = 'C:\madjzuyo\z71iw9ddxfu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto IKE Video Session Program Trap Encryption] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\madjzuyo\xwx0uqlz.exe' "c:\madjzuyo\z71iw9ddxfu.exe"
- 'C:\madjzuyo\z71iw9ddxfu.exe'
- 'C:\madjzuyo\qn5c8ph2zaujnubrilu.exe'
Modifies file system:
Creates the following files:
- %TEMP%\WER2ecc.dir00\xwx0uqlz.exe.mdmp
- C:\madjzuyo\fhawkaqvymj0
- %TEMP%\WER2ecc.dir00\xwx0uqlz.exe.hdmp
- %TEMP%\WER2ecc.dir00\manifest.txt
- %TEMP%\WER2ecc.dir00\appcompat.txt
- C:\madjzuyo\plcmerqj7lot
- %WINDIR%\madjzuyo\plcmerqj7lot
- C:\madjzuyo\qn5c8ph2zaujnubrilu.exe
- C:\madjzuyo\xwx0uqlz.exe
- C:\madjzuyo\z71iw9ddxfu.exe
Sets the 'hidden' attribute to the following files:
- C:\madjzuyo\xwx0uqlz.exe
- C:\madjzuyo\z71iw9ddxfu.exe
Deletes the following files:
- C:\madjzuyo\qn5c8ph2zaujnubrilu.exe
- %WINDIR%\madjzuyo\plcmerqj7lot
Substitutes the following files:
- %WINDIR%\madjzuyo\plcmerqj7lot
Network activity:
Connects to:
- 'wi#####inafrederick.net':80
- 'sa######ellfrederick.net':80
- 'wi#####inaphilomena.net':80
- 'sa######ellgallagher.net':80
- 'wi#####inakristina.net':80
- 'sa#####rellkristina.net':80
- 'wi#####inagallagher.net':80
- 'wa#####tongallagher.net':80
- 'ea#####inefrederick.net':80
- 'wa#####tonfrederick.net':80
- 'ea#####inegallagher.net':80
- 'sa######ellphilomena.net':80
- 'ea#####inekristina.net':80
- 'wa#####tonkristina.net':80
- 'ma######ianphilomena.net':80
- 'be#####ardfrederick.net':80
- 'ev#####inaphilomena.net':80
- 'be#####ardphilomena.net':80
- 'ev#####inafrederick.net':80
- 'be#####ardkristina.net':80
- 'ev#####inagallagher.net':80
- 'be#####ardgallagher.net':80
- 'gw#####inefrederick.net':80
- 'ma######ianfrederick.net':80
- 'gw#####inephilomena.net':80
- 'ma######iangallagher.net':80
- 'gw#####inekristina.net':80
- 'ma#####liankristina.net':80
- 'gw#####inegallagher.net':80
- 'ea#####inephilomena.net':80
- 'ma#####llagallagher.net':80
- 'al######inagallagher.net':80
- 'ma#####llafrederick.net':80
- 'al#####rinakristina.net':80
- 'wi#####hbyphilomena.net':80
- 'ba######mewphilomena.net':80
- 'ma#####llakristina.net':80
- 'ri######nemurgatroyd.net':80
- 'ev######necristiansen.net':80
- 'ri######necristiansen.net':80
- 'ev######nemurgatroyd.net':80
- 'al######inafrederick.net':80
- 'ma#####llaphilomena.net':80
- 'al######inaphilomena.net':80
- 'ba######mewfrederick.net':80
- 'ch#####anagallagher.net':80
- 'du#####llafrederick.net':80
- 'ch#####anafrederick.net':80
- 'du#####llagallagher.net':80
- 'wa#####tonphilomena.net':80
- 'du#####llakristina.net':80
- 'ch#####anakristina.net':80
- 'wi#####hbygallagher.net':80
- 'ba######mewgallagher.net':80
- 'wi#####hbyfrederick.net':80
- 'ba#####omewkristina.net':80
- 'du#####llaphilomena.net':80
- 'ch#####anaphilomena.net':80
- 'wi#####hbykristina.net':80
TCP:
HTTP GET requests:
- http://wi#####inafrederick.net/index.php
- http://sa######ellfrederick.net/index.php
- http://wi#####inaphilomena.net/index.php
- http://sa######ellgallagher.net/index.php
- http://wi#####inakristina.net/index.php
- http://sa#####rellkristina.net/index.php
- http://wi#####inagallagher.net/index.php
- http://wa#####tongallagher.net/index.php
- http://ea#####inefrederick.net/index.php
- http://wa#####tonfrederick.net/index.php
- http://ea#####inegallagher.net/index.php
- http://sa######ellphilomena.net/index.php
- http://ea#####inekristina.net/index.php
- http://wa#####tonkristina.net/index.php
- http://ma######ianphilomena.net/index.php
- http://be#####ardfrederick.net/index.php
- http://ev#####inaphilomena.net/index.php
- http://be#####ardphilomena.net/index.php
- http://ev#####inafrederick.net/index.php
- http://be#####ardkristina.net/index.php
- http://ev#####inagallagher.net/index.php
- http://be#####ardgallagher.net/index.php
- http://gw#####inefrederick.net/index.php
- http://ma######ianfrederick.net/index.php
- http://gw#####inephilomena.net/index.php
- http://ma######iangallagher.net/index.php
- http://gw#####inekristina.net/index.php
- http://ma#####liankristina.net/index.php
- http://gw#####inegallagher.net/index.php
- http://ea#####inephilomena.net/index.php
- http://ma#####llagallagher.net/index.php
- http://al######inagallagher.net/index.php
- http://ma#####llafrederick.net/index.php
- http://al#####rinakristina.net/index.php
- http://wi#####hbyphilomena.net/index.php
- http://ba######mewphilomena.net/index.php
- http://ma#####llakristina.net/index.php
- http://ri######nemurgatroyd.net/index.php
- http://ev######necristiansen.net/index.php
- http://ri######necristiansen.net/index.php
- http://ev######nemurgatroyd.net/index.php
- http://al######inafrederick.net/index.php
- http://ma#####llaphilomena.net/index.php
- http://al######inaphilomena.net/index.php
- http://ba######mewfrederick.net/index.php
- http://ch#####anagallagher.net/index.php
- http://du#####llafrederick.net/index.php
- http://ch#####anafrederick.net/index.php
- http://du#####llagallagher.net/index.php
- http://wa#####tonphilomena.net/index.php
- http://du#####llakristina.net/index.php
- http://ch#####anakristina.net/index.php
- http://wi#####hbygallagher.net/index.php
- http://ba######mewgallagher.net/index.php
- http://wi#####hbyfrederick.net/index.php
- http://ba#####omewkristina.net/index.php
- http://du#####llaphilomena.net/index.php
- http://ch#####anaphilomena.net/index.php
- http://wi#####hbykristina.net/index.php
UDP:
- DNS ASK sa######ellgallagher.net
- DNS ASK wi#####inafrederick.net
- DNS ASK sa######ellfrederick.net
- DNS ASK wi#####inagallagher.net
- DNS ASK ma######ianphilomena.net
- DNS ASK wi#####inakristina.net
- DNS ASK sa#####rellkristina.net
- DNS ASK wi#####inaphilomena.net
- DNS ASK wa#####tongallagher.net
- DNS ASK ea#####inefrederick.net
- DNS ASK wa#####tonfrederick.net
- DNS ASK ea#####inegallagher.net
- DNS ASK sa######ellphilomena.net
- DNS ASK ea#####inekristina.net
- DNS ASK wa#####tonkristina.net
- DNS ASK ev#####inafrederick.net
- DNS ASK be#####ardfrederick.net
- DNS ASK ev#####inaphilomena.net
- DNS ASK be#####ardgallagher.net
- DNS ASK ev#####inakristina.net
- DNS ASK be#####ardkristina.net
- DNS ASK ev#####inagallagher.net
- DNS ASK be#####ardphilomena.net
- DNS ASK gw#####inefrederick.net
- DNS ASK ma######ianfrederick.net
- DNS ASK gw#####inephilomena.net
- DNS ASK ma######iangallagher.net
- DNS ASK gw#####inekristina.net
- DNS ASK ma#####liankristina.net
- DNS ASK gw#####inegallagher.net
- DNS ASK al#####rinakristina.net
- DNS ASK ma#####llagallagher.net
- DNS ASK al######inagallagher.net
- DNS ASK ma#####llakristina.net
- DNS ASK ba######mewfrederick.net
- DNS ASK wi#####hbyphilomena.net
- DNS ASK ba######mewphilomena.net
- DNS ASK ma#####llafrederick.net
- DNS ASK ri######nemurgatroyd.net
- DNS ASK ev######necristiansen.net
- DNS ASK ri######necristiansen.net
- DNS ASK ev######nemurgatroyd.net
- DNS ASK al######inafrederick.net
- DNS ASK ma#####llaphilomena.net
- DNS ASK al######inaphilomena.net
- DNS ASK du#####llagallagher.net
- DNS ASK ch#####anagallagher.net
- DNS ASK du#####llafrederick.net
- DNS ASK ch#####anakristina.net
- DNS ASK ea#####inephilomena.net
- DNS ASK wa#####tonphilomena.net
- DNS ASK du#####llakristina.net
- DNS ASK ch#####anafrederick.net
- DNS ASK wi#####hbygallagher.net
- DNS ASK ba######mewgallagher.net
- DNS ASK wi#####hbyfrederick.net
- DNS ASK ba#####omewkristina.net
- DNS ASK du#####llaphilomena.net
- DNS ASK ch#####anaphilomena.net
- DNS ASK wi#####hbykristina.net
