Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{ZORS7KTS-H7K8-EBNO-VMI7-QISBTPA7TIX}' = '"%APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\r-8-8-64-1058640476-1330115106-1205953419-6724\{zors7kts-h7k8-ebno-vmi7-qisbtpa7tix}
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2716
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 1872
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2384
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 1364
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2912
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 3060
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 540
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 772
Reads files which store third party applications passwords
- <LS_APPDATA>\google\chrome\user data\default\login data
- <LS_APPDATA>\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\aut99a7.tmp
- %APPDATA%\xea4qpdwhyibcsi4\build.exe
- %APPDATA%\amd64_microsoft-windows-directui.resources\enu_4687fe970ce379002535
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\zo223gcg\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\nx6nl80v\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\ok5myrei\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\kafy9ys1\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %APPDATA%\xea4qpdwhyibcsi4\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\autd190.tmp
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.sqlite3.module.dll
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\screen.jpg
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\steam\config\config.vdf
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\steam\инструкция по установке.txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\steam\config\dialogconfig.vdf
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\telegram\d877f783d5d3ef8c\map0
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\telegram\инструкция по установке.txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\telegram\d877f783d5d3ef8c1
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\cookies\mozilla firefox (6).txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\information.txt
- %TEMP%\aut693c.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.module.exe.9
- %TEMP%\aut22fb.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.sqlite3.module.dll.9
- %TEMP%\autcf6d.tmp
- %APPDATA%\rmuqdesbfhyor\build.exe
- %TEMP%\autcab8.tmp
- %TEMP%\aut9d13.tmp
- %APPDATA%\qdge9mxxtnuaeicp6p\build.exe
- %TEMP%\aut9f08.tmp
- %APPDATA%\vgpyotuosuzmbzx\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\auta1f7.tmp
- %APPDATA%\vgpyotuosuzmbzx\build.exe
- %TEMP%\auta591.tmp
- %APPDATA%\a1bnse9msdhg\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\auta93c.tmp
- %APPDATA%\a1bnse9msdhg\build.exe
- %TEMP%\autab02.tmp
- %APPDATA%\cv4dlxshumz7itfdyrovab\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\autae8d.tmp
- %APPDATA%\qdge9mxxtnuaeicp6p\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %APPDATA%\cv4dlxshumz7itfdyrovab\build.exe
- %APPDATA%\4ucd71omyllvutqcx4\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\autb565.tmp
- %APPDATA%\4ucd71omyllvutqcx4\build.exe
- %TEMP%\autba96.tmp
- %APPDATA%\y2iomicpagbo2f8re\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\autbd85.tmp
- %APPDATA%\y2iomicpagbo2f8re\build.exe
- %TEMP%\autbf5b.tmp
- %APPDATA%\ds48gk28hbwaf\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\autc3d1.tmp
- %APPDATA%\ds48gk28hbwaf\build.exe
- %TEMP%\autc5b6.tmp
- %APPDATA%\rmuqdesbfhyor\1529398874_morana-batori-goryachie-slitye-foto-video-26.jpg
- %TEMP%\autb0b1.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.module.exe
- %APPDATA%\amd64_microsoft-windows-directui.resources\enu_4687fe970ce379002535.7z
Sets the 'hidden' attribute to the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\zo223gcg\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\nx6nl80v\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\ok5myrei\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\kafy9ys1\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut99a7.tmp
- %APPDATA%\4ucd71omyllvutqcx4\build.exe
- %APPDATA%\rmuqdesbfhyor\build.exe
- %APPDATA%\ds48gk28hbwaf\build.exe
- %TEMP%\aut22fb.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.sqlite3.module.dll.9
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.sqlite3.module.dll
- %TEMP%\aut693c.tmp
- %TEMP%\autba96.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.module.exe.9
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\information.txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\screen.jpg
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\cookies\mozilla firefox (6).txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\steam\инструкция по установке.txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\steam\config\config.vdf
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\steam\config\dialogconfig.vdf
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\telegram\d877f783d5d3ef8c1
- %APPDATA%\qdge9mxxtnuaeicp6p\build.exe
- %APPDATA%\a1bnse9msdhg\build.exe
- %APPDATA%\y2iomicpagbo2f8re\build.exe
- %APPDATA%\xea4qpdwhyibcsi4\build.exe
- %APPDATA%\cv4dlxshumz7itfdyrovab\build.exe
- %TEMP%\aut9f08.tmp
- %TEMP%\auta1f7.tmp
- %TEMP%\auta591.tmp
- %TEMP%\auta93c.tmp
- %TEMP%\autab02.tmp
- %TEMP%\autae8d.tmp
- %TEMP%\autb0b1.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\telegram\инструкция по установке.txt
- %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.module.exe
- %TEMP%\autb565.tmp
- %TEMP%\autbf5b.tmp
- %TEMP%\autc3d1.tmp
- %TEMP%\autc5b6.tmp
- %TEMP%\autcab8.tmp
- %TEMP%\autcf6d.tmp
- %TEMP%\autd190.tmp
- <SYSTEM32>\tasks\r-8-8-64-1058640476-1330115106-1205953419-6724\{zors7kts-h7k8-ebno-vmi7-qisbtpa7tix}
- %TEMP%\aut9d13.tmp
- %TEMP%\autbd85.tmp
- %APPDATA%\amd64_microsoft-windows-directui.resources\1\telegram\d877f783d5d3ef8c\map0
Moves the following files
- from %APPDATA%\vgpyotuosuzmbzx\build.exe to %APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.exe
Network activity
Connects to
- '18#.#8.84.103':65233
UDP
- DNS ASK ap#.##legram.org
- DNS ASK ip##i.co
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\qdge9mxxtnuaeicp6p\build.exe'
- '%APPDATA%\vgpyotuosuzmbzx\build.exe'
- '%APPDATA%\a1bnse9msdhg\build.exe'
- '%APPDATA%\cv4dlxshumz7itfdyrovab\build.exe'
- '%APPDATA%\4ucd71omyllvutqcx4\build.exe'
- '%APPDATA%\y2iomicpagbo2f8re\build.exe'
- '%APPDATA%\ds48gk28hbwaf\build.exe'
- '%APPDATA%\rmuqdesbfhyor\build.exe'
- '%APPDATA%\xea4qpdwhyibcsi4\build.exe'
- '%APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.module.exe' a -y -mx9 -ssw "%APPDATA%\amd64_microsoft-windows-directui.resources\ENU_4687FE970CE379002535.7z" "%APPDATA%\amd64_microsoft-windows-directui.resources\1\*"
- '%APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 2716 & attrib -s -h -r -a /S /D "%APPDATA%\cv4DlXSHumz7iTFDyRovaB" & del /q /f "%APPDATA%\cv4DlXSHumz7iTFDyRovaB\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 3060 & attrib -s -h -r -a /S /D "%APPDATA%\Y2IomiCPagbo2f8rE" & del /q /f "%APPDATA%\Y2IomiCPagbo2f8rE\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 2912 & attrib -s -h -r -a /S /D "%APPDATA%\xEA4qpDwHYIbcsI4" & del /q /f "%APPDATA%\xEA4qpDwHYIbcsI4\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 540 & attrib -s -h -r -a /S /D "%APPDATA%\rMuQDeSBfHyor" & del /q /f "%APPDATA%\rMuQDeSBfHyor\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 772 & attrib -s -h -r -a /S /D "%APPDATA%\DS48Gk28HBWAf" & del /q /f "%APPDATA%\DS48Gk28HBWAf\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 2384 & attrib -s -h -r -a /S /D "%APPDATA%\a1BnSe9msdhG" & del /q /f "%APPDATA%\a1BnSe9msdhG\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 1364 & attrib -s -h -r -a /S /D "%APPDATA%\QdgE9MxXTNuAeiCp6p" & del /q /f "%APPDATA%\QdgE9MxXTNuAeiCp6p\Build.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 1872 & attrib -s -h -r -a /S /D "%APPDATA%\4UcD71oMYlLVUTQCx4" & del /q /f "%APPDATA%\4UcD71oMYlLVUTQCx4\Build.exe"' (with hidden window)
- '%APPDATA%\amd64_microsoft-windows-directui.resources\winmmbase.module.exe' a -y -mx9 -ssw "%APPDATA%\amd64_microsoft-windows-directui.resources\ENU_4687FE970CE379002535.7z" "%APPDATA%\amd64_microsoft-windows-directui.resources\1\*"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\amd64_microsoft-windows-directui.resources"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 2716 & attrib -s -h -r -a /S /D "%APPDATA%\cv4DlXSHumz7iTFDyRovaB" & del /q /f "%APPDATA%\cv4DlXSHumz7iTFDyRovaB\Build.exe"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\DS48Gk28HBWAf"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\Y2IomiCPagbo2f8rE"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\rMuQDeSBfHyor"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\xEA4qpDwHYIbcsI4"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\4UcD71oMYlLVUTQCx4"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\a1BnSe9msdhG"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\QdgE9MxXTNuAeiCp6p"
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a /S /D "%APPDATA%\cv4DlXSHumz7iTFDyRovaB"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 2912 & attrib -s -h -r -a /S /D "%APPDATA%\xEA4qpDwHYIbcsI4" & del /q /f "%APPDATA%\xEA4qpDwHYIbcsI4\Build.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 540 & attrib -s -h -r -a /S /D "%APPDATA%\rMuQDeSBfHyor" & del /q /f "%APPDATA%\rMuQDeSBfHyor\Build.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 772 & attrib -s -h -r -a /S /D "%APPDATA%\DS48Gk28HBWAf" & del /q /f "%APPDATA%\DS48Gk28HBWAf\Build.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 3060 & attrib -s -h -r -a /S /D "%APPDATA%\Y2IomiCPagbo2f8rE" & del /q /f "%APPDATA%\Y2IomiCPagbo2f8rE\Build.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 1364 & attrib -s -h -r -a /S /D "%APPDATA%\QdgE9MxXTNuAeiCp6p" & del /q /f "%APPDATA%\QdgE9MxXTNuAeiCp6p\Build.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 1872 & attrib -s -h -r -a /S /D "%APPDATA%\4UcD71oMYlLVUTQCx4" & del /q /f "%APPDATA%\4UcD71oMYlLVUTQCx4\Build.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /pid 2384 & attrib -s -h -r -a /S /D "%APPDATA%\a1BnSe9msdhG" & del /q /f "%APPDATA%\a1BnSe9msdhG\Build.exe"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\amd64_microsoft-windows-directui.resources"
