Technical Information
Malicious functions:
Injects code into
the following system processes:
the following user processes:
Modifies file system:
Creates the following files:
- %TEMP%\kyg01nqi.0.cs
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3012.tmp
- %TEMP%\kyg01nqi.cmdline
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3052.tmp
- %TEMP%\kyg01nqi.out
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3004.tmp
- %TEMP%\4.tmp\5.bat
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2944.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2952.tmp
- %APPDATA%\VOS\New Package ID\PROG\%Temp%\Logger.exe
- %APPDATA%\VOS\New Package ID\PROG\%Temp%\trara.exe
- %TEMP%\Microsoft_SQL_SDKs\AzureService.exe
- %TEMP%\kyg01nqi.dll
- %TEMP%\MSBuild.exe
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3340.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3296.tmp
- %TEMP%\23F9F.dmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3088.tmp
- %TEMP%\CSC7.tmp
- %TEMP%\RES8.tmp
- %TEMP%\dw.log
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3176.tmp
- %APPDATA%\VOS\New Package ID\PROG\%Temp%\start.exe
- %APPDATA%\VOS\New Package ID\EngineStamps\AppVirtDll_New Package ID.dll.20180219-070517.454.stamp
- %APPDATA%\VOS\New Package ID\AppVirtDll_New Package ID.dll
- %APPDATA%\VOS\New Package ID\AppVirtDll64_New Package ID.dll
- %APPDATA%\VOS\New Package ID\New Package ID.exe
- %APPDATA%\VOS\New Package ID\EngineStamps\AppVirtDll64_New Package ID.dll.20180219-070517.469.stamp
- %APPDATA%\VOS\New Package ID\VirtApp.ini
- %TEMP%\nsa3.tmp\System.dll
- %TEMP%\nsk2.tmp
- %APPDATA%\1337\nvidia_update.exe
- %TEMP%\~DF9D8F.tmp
- %APPDATA%\1337\skiHack.exe
- %APPDATA%\VOS\New Package ID\EngineStamps\DiskModeDeploy.marker
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2912.tmp
- %APPDATA%\VOS\New Package ID\ZipCache
- %APPDATA%\VOS\New Package ID\CHANGES\CryptCheck.dat
- %APPDATA%\VOS\New Package ID\EngineStamps\ZipCache.20180219-070606.629.stamp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db
- %APPDATA%\VOS\New Package ID\New Package ID64.exe
- %APPDATA%\VOS\New Package ID\EngineStamps\New Package ID.exe.20180219-070517.491.stamp
- %APPDATA%\VOS\New Package ID\EngineStamps\New Package ID64.exe.20180219-070517.497.stamp
- %APPDATA%\VOS\New Package ID\EngineStamps\VirtFiles.Prog.db.20180219-070606.630.stamp
- %APPDATA%\VOS\New Package ID\VirtFiles.Prog.db
Sets the 'hidden' attribute to the following files:
- %TEMP%\MSBuild.exe
Deletes the following files:
- %TEMP%\kyg01nqi.0.cs
- %TEMP%\CSC7.tmp
- %TEMP%\kyg01nqi.out
- %TEMP%\kyg01nqi.dll
- %TEMP%\kyg01nqi.cmdline
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db
- %TEMP%\nsa3.tmp\System.dll
- %TEMP%\~DF9D8F.tmp
- %TEMP%\RES8.tmp
- %TEMP%\4.tmp\5.bat
Substitutes the following files:
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2912.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db
Network activity:
Connects to:
- 'ip###ger.com':443
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK ip###ger.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GFXSVR'
Creates and executes the following:
- '%APPDATA%\VOS\New Package ID\PROG\%Temp%\trara.exe' trara.exe
- '%APPDATA%\VOS\New Package ID\PROG\%Temp%\Logger.exe' Logger.exe
- '%APPDATA%\1337\nvidia_update.exe'
- '%APPDATA%\VOS\New Package ID\PROG\%Temp%\start.exe'
Executes the following:
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 944
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn \Defender\CheckUpdate /tr "%TEMP%\MSBuild.exe" /st 08:33 /du 9999:59 /sc daily /ri 1 /f
- '<SYSTEM32>\schtasks.exe' /create /tn \Defender\CheckUpdate /tr "%TEMP%\MSBuild.exe" /st 08:33 /du 9999:59 /sc daily /ri 1 /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\4.tmp\5.bat" "%TEMP%\start.exe""
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\kyg01nqi.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8.tmp" "%TEMP%\CSC7.tmp"
