Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GUJmJTJ8' = '"%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GUJmJTJ8' = '"%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\GUJmJTJ8.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\GUJmJTJ8.lnk
Malicious functions:
Injects code into
the following user processes:
- Vw7CDRn8.exe
Modifies file system:
Creates the following files:
- %APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe
- %APPDATA%\VGvbP2WzUpsN\jNu9znl7.cmd
- %APPDATA%\Microsoft\Vw7CDRn8.exe
- <LS_APPDATA>\Microsoft\WairVl6h.exe
- %APPDATA%\Readme-Matrix.rtf
- %HOMEPATH%\Templates\Readme-Matrix.rtf
- C:\Far2\Addons\Readme-Matrix.rtf
- C:\Far2\Documentation\eng\Readme-Matrix.rtf
- C:\Far2\Documentation\rus\Readme-Matrix.rtf
- C:\Far2\Plugins\7-Zip\Readme-Matrix.rtf
- C:\Far2\Plugins\Colorer\hrc\Readme-Matrix.rtf
- C:\Far2\Plugins\ExtSearch\doc\Readme-Matrix.rtf
- C:\Far2\Plugins\FTP\Readme-Matrix.rtf
- <STUBS_DIR>\Readme-Matrix.rtf
Deletes the following files:
- <Full path to file>
Network activity:
Connects to:
- 'st######enny.atwebpages.com':80
TCP:
HTTP GET requests:
- http://st######enny.atwebpages.com/addrecord.php?ap#################################################################################################
- http://st######enny.atwebpages.com/addrecord.php?ap#######################################################################################################
UDP:
- DNS ASK st######enny.atwebpages.com
Miscellaneous:
Creates and executes the following:
- '<Full path to file>'
- '%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe' lwOcZpKJ83bb90CQ
- '%APPDATA%\Microsoft\Vw7CDRn8.exe' "%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe" "<LS_APPDATA>\Microsoft\WairVl6h.exe" 1
- '<LS_APPDATA>\Microsoft\WairVl6h.exe' "%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe" "%APPDATA%\Microsoft\Vw7CDRn8.exe" 2
Executes the following:
- '<SYSTEM32>\cmd.exe' /C "%APPDATA%\VGvbP2WzUpsN\jNu9znl7.cmd"
- '<SYSTEM32>\ping.exe' -n 6 localhost
- '<SYSTEM32>\cmd.exe' /C reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "GUJmJTJ8" /t REG_SZ /f /d "\"%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe"\"
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "GUJmJTJ8" /t REG_SZ /f /d "\"%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe"\"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "GUJmJTJ8" /t REG_SZ /f /d "\"%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe"\"
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "GUJmJTJ8" /t REG_SZ /f /d "\"%APPDATA%\VGvbP2WzUpsN\GUJmJTJ8.exe"\"
- '<SYSTEM32>\cmd.exe' /C CACLS "Z:\.live" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "Z:\.live"
- '<SYSTEM32>\cacls.exe' "Z:\.live" /E /G %USERNAME%:F /C
