Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate7n4n5drgte' = '%TEMP%\95199650\aqj.exe %TEMP%\95199650\olw=slo'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\95199650\shj.txt
- %TEMP%\95199650\xkn.jpg
- %TEMP%\95199650\xvx.docx
- %TEMP%\95199650\oai.pdf
- %TEMP%\95199650\cxw.bmp
- %TEMP%\95199650\qkv.ico
- %TEMP%\95199650\dat.txt
- %TEMP%\95199650\xku.ppt
- %TEMP%\95199650\tur.txt
- %TEMP%\95199650\exf.mp4
- %TEMP%\95199650\sav.mp4
- %TEMP%\95199650\gui.xl
- %TEMP%\95199650\spd
- %TEMP%\95199650\JWQMA
- %TEMP%\95199650\ool.xl
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.svr
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.dat
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.nfo
- %TEMP%\95199650\wdw.dat
- %TEMP%\95199650\avp.jpg
- %TEMP%\95199650\fag.ico
- %TEMP%\95199650\wbs.mp3
- %TEMP%\95199650\mhw.mp3
- %TEMP%\95199650\oag.bmp
- %TEMP%\95199650\nlb.bmp
- %TEMP%\95199650\whc.txt
- %TEMP%\95199650\gmg.pdf
- %TEMP%\95199650\ljd.dat
- %TEMP%\95199650\pwp.ppt
- %TEMP%\95199650\rxi.docx
- %TEMP%\95199650\aqj.exe
- %TEMP%\95199650\olw=slo
- %TEMP%\95199650\rxw.dat
- %TEMP%\95199650\fwa.docx
- %TEMP%\95199650\tcl.xl
- %TEMP%\95199650\vok.dat
- %TEMP%\95199650\bav.ppt
- %TEMP%\95199650\svg.mp3
- %TEMP%\95199650\xiv.icm
- %TEMP%\95199650\nwj.docx
- %TEMP%\95199650\qsq.mp3
- %TEMP%\95199650\ket.dat
- %TEMP%\95199650\pfb.ppt
- %TEMP%\95199650\pox.mp4
- %TEMP%\95199650\ovm.ico
- %TEMP%\95199650\uch.docx
- %TEMP%\95199650\drr.mp3
- %TEMP%\95199650\sqw.jpg
Sets the 'hidden' attribute to the following files:
- %TEMP%\95199650\sqw.jpg
- %TEMP%\95199650\shj.txt
- %TEMP%\95199650\svg.mp3
- %TEMP%\95199650\tur.txt
- %TEMP%\95199650\tcl.xl
- %TEMP%\95199650\sav.mp4
- %TEMP%\95199650\qkv.ico
- %TEMP%\95199650\pwp.ppt
- %TEMP%\95199650\qsq.mp3
- %TEMP%\95199650\rxw.dat
- %TEMP%\95199650\rxi.docx
- %TEMP%\95199650\uch.docx
- %TEMP%\95199650\xvx.docx
- %TEMP%\95199650\xku.ppt
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.nfo
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.svr
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.dat
- %TEMP%\95199650\xkn.jpg
- %TEMP%\95199650\wbs.mp3
- %TEMP%\95199650\vok.dat
- %TEMP%\95199650\wdw.dat
- %TEMP%\95199650\xiv.icm
- %TEMP%\95199650\whc.txt
- %TEMP%\95199650\fag.ico
- %TEMP%\95199650\exf.mp4
- %TEMP%\95199650\fwa.docx
- %TEMP%\95199650\gui.xl
- %TEMP%\95199650\gmg.pdf
- %TEMP%\95199650\drr.mp3
- %TEMP%\95199650\avp.jpg
- %TEMP%\95199650\aqj.exe
- %TEMP%\95199650\bav.ppt
- %TEMP%\95199650\dat.txt
- %TEMP%\95199650\cxw.bmp
- %TEMP%\95199650\ket.dat
- %TEMP%\95199650\ool.xl
- %TEMP%\95199650\olw=slo
- %TEMP%\95199650\ovm.ico
- %TEMP%\95199650\pox.mp4
- %TEMP%\95199650\pfb.ppt
- %TEMP%\95199650\oai.pdf
- %TEMP%\95199650\mhw.mp3
- %TEMP%\95199650\ljd.dat
- %TEMP%\95199650\nlb.bmp
- %TEMP%\95199650\oag.bmp
- %TEMP%\95199650\nwj.docx
Deletes the following files:
- %TEMP%\95199650\JWQMA
- %APPDATA%\Microsoft\Windows\XGgA6Wbi\XGgA6Wbi.svr
Network activity:
Connects to:
- 'rs######r.jumpingcrab.com':900
- 'rs####.ntdll.net':900
- 'wi####up.16-b.it':900
- 'c0######.is-not-certified.com':900
UDP:
- DNS ASK rs######r.jumpingcrab.com
- DNS ASK rs####.ntdll.net
- DNS ASK c0######.is-not-certified.com
- DNS ASK www.google.com
- DNS ASK wi####up.16-b.it
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\95199650\aqj.exe' %TEMP%\95199650\JWQMA
- '%TEMP%\95199650\aqj.exe' olw=slo
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
