Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\FalconForensicsService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\FalconForensicsService] 'ImagePath' = '"<Current directory>\<File name>32.exe" -# "<Full path to file>" -i "<Full path to file>" '
Modifies file system:
Creates the following files:
- %TEMP%\csBFC807E8B21C924FA2CA52F0E8DFBA56.tmp
- %WINDIR%\Temp\Cab5.tmp
- %WINDIR%\Temp\Cab3.tmp
- %WINDIR%\Temp\Cab1.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %WINDIR%\Temp\Cab7.tmp
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217
- <SYSTEM32>\onyxwalrus,CRNJEUFU,10.0.0.2,2018-07-20T03_05_09Z.xml
- <Current directory>\<File name>32.log
- <Current directory>\<File name>32.exe
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165
- %WINDIR%\Temp\Cab9.tmp
Deletes the following files:
- %TEMP%\csBFC807E8B21C924FA2CA52F0E8DFBA56.tmp
- %WINDIR%\Temp\Cab1.tmp
- %WINDIR%\Temp\Cab3.tmp
- %WINDIR%\Temp\Cab5.tmp
- %WINDIR%\Temp\Cab7.tmp
- %WINDIR%\Temp\Cab9.tmp
Network activity:
Connects to:
- 'wp#d':80
- '20#.#6.232.182':80
- 'crl.verisign.com':80
- 'download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/WindowsPCA.crl via 20#.#6.232.182
- http://crl.verisign.com/ThawteTimestampingCA.crl
- http://crl.verisign.com/tss-ca.crl
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
UDP:
- DNS ASK wp#d
- DNS ASK crl.microsoft.com
- DNS ASK crl.verisign.com
- DNS ASK www.download.windowsupdate.com
- DNS ASK cr#.#hawte.com
Miscellaneous:
Creates and executes the following:
- '<Current directory>\<File name>32.exe' -# "<Full path to file>" -i "<Full path to file>"
