Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\BootSys.url
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\wuauclt.exe
- <SYSTEM32>\auditusr.exe
Modifies file system:
Creates the following files:
- %TEMP%\td0v4bbb.0.cs
- %TEMP%\td0v4bbb.cmdline
- %TEMP%\td0v4bbb.out
Sets the 'hidden' attribute to the following files:
- C:\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe
Deletes the following files:
- %TEMP%\td0v4bbb.out
- %TEMP%\td0v4bbb.0.cs
- %TEMP%\td0v4bbb.cmdline
Moves the following files:
- from <Full path to file> to C:\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe
Network activity:
Connects to:
- 'wp#d':80
- 'ip###ger.com':443
- '10#.#34.34.48':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://10#.#34.34.48/builds/f707db00b39990ed0bdacadf4603106f/Gefest.exe
UDP:
- DNS ASK wp#d
- DNS ASK ip###ger.com
Miscellaneous:
Executes the following:
- '<SYSTEM32>\clipbrd.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\cacls.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\cmstp.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\diskperf.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\magnify.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\relog.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\tlntsess.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\shrpubw.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\ahui.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\recover.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\taskman.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\odbcad32.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\wuauclt.exe' /create /tn 23ef5514-3059-436f-a4a7-4cefaab20eb1 /tr "rundll32.exe url.dll,OpenURLA "\23ef5514-3059-436f-a4a7-4cefaab20eb1\fa6a3.exe"" /st 00:00 /sc daily /du 9999:59 /ri 10 /f
- '<SYSTEM32>\auditusr.exe'
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\td0v4bbb.cmdline"
