Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\hduzicz.exe
Malicious functions:
Creates and executes the following:
- '%HOMEPATH%\My Documents\ActivationAcronisTI(H).exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language" /v InstallLanguage
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language" /v InstallLanguage
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Activation.cmd" "
- '<SYSTEM32>\calc.exe'
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %TEMP%\7ZipSfx.000\17.0.0.6673\libcrypto10.dll
- %TEMP%\7ZipSfx.000\17.0.0.6614\libcrypto10.dll
- %TEMP%\7ZipSfx.000\17.0.0.6688\libcrypto10.dll
- %TEMP%\7ZipSfx.000\18.0.0.6055\libcrypto10.dll
- %TEMP%\7ZipSfx.000\18.0.0.5539\libcrypto10.dll
- %TEMP%\7ZipSfx.000\17.0.0.5560\libcrypto10.dll
- %TEMP%\7ZipSfx.000\15.0.0.7133\libcrypto10.dll
- %TEMP%\7ZipSfx.000\15.0.0.6131\libcrypto10.dll
- %TEMP%\7ZipSfx.000\16.0.0.5587\libcrypto10.dll
- %TEMP%\7ZipSfx.000\16.0.0.6528\libcrypto10.dll
- %TEMP%\7ZipSfx.000\16.0.0.6514\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.5628\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.5620\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.5634\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.6559\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.6027\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.5586\libcrypto10.dll
- %TEMP%\7ZipSfx.000\18.0.0.6613\libcrypto10.dll
- %TEMP%\7ZipSfx.000\18.0.0.6525\libcrypto10.dll
- %TEMP%\7ZipSfx.000\18.0.0.6615\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.5576\libcrypto10.dll
- %TEMP%\7ZipSfx.000\19.0.0.5518\libcrypto10.dll
- %TEMP%\7ZipSfx.000\16.0.0.5551\libcrypto10.dll
- %TEMP%\7ZipSfx.000\TrueImageReadme\liesmich2012.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\DiskDirector12.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\liesmich2013.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\liesmich2015.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\liesmich2014.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\CHANGELOG.txt
- <SYSTEM32>\.Identifier
- %HOMEPATH%\My Documents\ActivationAcronisTI(H).exe
- %TEMP%\7ZipSfx.000\Activation.cmd
- %TEMP%\7ZipSfx.000\Activation_en.cmd
- %TEMP%\7ZipSfx.000\Activation_de.cmd
- %TEMP%\7ZipSfx.000\TrueImageReadme\readmePreviousBuilds.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\readmeOtherLanguages.txt
- %TEMP%\7ZipSfx.000\Acronis_x64.reg
- %TEMP%\7ZipSfx.000\filever.exe
- %TEMP%\7ZipSfx.000\Acronis_x86.reg
- %TEMP%\7ZipSfx.000\TrueImageReadme\readme2016.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\readme2012.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\liesmich2016.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\readme2013.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\readme2015.txt
- %TEMP%\7ZipSfx.000\TrueImageReadme\readme2014.txt
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\.Identifier
Network activity:
Connects to:
- '13#.#9.176.119':56565
