Technical Information
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\calc.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\calc.exe
- <SYSTEM32>\notepad.exe
Modifies file system:
Creates the following files:
- %APPDATA%\atl110\WSReset.exe
- %TEMP%\aut1.tmp
- %TEMP%\wnwddsx
- %TEMP%\LZMA.DLL
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\wnwddsx
Miscellaneous:
Creates and executes the following:
- '<Full path to file>'
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /tn tzsync /tr "%APPDATA%\atl110\WSReset.exe" /sc minute /mo 1 /F
- '<SYSTEM32>\calc.exe' -o pooleu.xmrminingpool.net:2222 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQtz7XNvpsygAzF9g1Y -p NativeTestCpu -k --max-cpu-usage=75
- '<SYSTEM32>\notepad.exe' -o pooleu.xmrminingpool.net:2222 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQtz7XNvpsygAzF9g1Y -p NativeTestCpuINACTIVO -k --max-cpu-usage=50
- '<SYSTEM32>\calc.exe' -o pooleu.xmrminingpool.net:2222 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQtz7XNvpsygAzF9g1Y -p NativeTestCpu -k --max-cpu-usage=50
