Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\--] 'ImagePath' = '<Full path to file> /wl 1'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\uninstaller.dat' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NjE1NGU5OTN.exe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\NjYzN2VkYjB' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles%\OGFhMDQ3NDc4Y' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\nsfd374.tmp\nsexec.dll
- %WINDIR%\temp\nsc1718.tmp\nsiscrypt.dll
- %WINDIR%\temp\nsc1718.tmp\simplesc.dll
- %WINDIR%\temp\nsc1718.tmp\md5dll.dll
- %WINDIR%\temp\nsc1718.tmp\ipconfig.dll
- %WINDIR%\temp\nsc1718.tmp\system.dll
- %WINDIR%\temp\nsm1707.tmp
- %WINDIR%\temp\nst16a.tmp\hlcmbdbypdc.dll
- %WINDIR%\temp\nst16a.tmp\rkhsfmxahzo.dll
- %WINDIR%\temp\nst16a.tmp\itonieln
- %TEMP%\nsjf4cb.tmp\inetc.dll
- %WINDIR%\temp\nst16a.tmp\nsexec.dll
- %TEMP%\nsjf4cb.tmp\nsiscrypt.dll
- %TEMP%\nsjf4cb.tmp\simplesc.dll
- %TEMP%\nsjf4cb.tmp\md5dll.dll
- %TEMP%\nsjf4cb.tmp\ipconfig.dll
- %TEMP%\nsjf4cb.tmp\system.dll
- %TEMP%\nsdf4aa.tmp
- %TEMP%\nsfd374.tmp\hlcmbdbypdc.dll
- %TEMP%\nsfd374.tmp\rkhsfmxahzo.dll
- %TEMP%\nsfd374.tmp\itonieln
- %TEMP%\nsjf4cb.tmp\nsexec.dll
- %TEMP%\nsjf4cb.tmp\moreinfo.dll
Deletes the following files
- %TEMP%\nsfd374.tmp\itonieln
- %TEMP%\nsfd374.tmp\nsexec.dll
- %TEMP%\nsfd374.tmp\rkhsfmxahzo.dll
- %WINDIR%\temp\nst16a.tmp\itonieln
- %WINDIR%\temp\nst16a.tmp\nsexec.dll
- %WINDIR%\temp\nst16a.tmp\rkhsfmxahzo.dll
- %WINDIR%\temp\nsc1718.tmp\ipconfig.dll
- %WINDIR%\temp\nsc1718.tmp\md5dll.dll
- %WINDIR%\temp\nsc1718.tmp\nsiscrypt.dll
- %WINDIR%\temp\nsc1718.tmp\simplesc.dll
- %WINDIR%\temp\nsc1718.tmp\system.dll
Network activity
UDP
- DNS ASK te####logietazo.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "powershell -command Add-MpPreference -ExclusionPath \"<Full path to file>\""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "powershell -command Add-MpPreference -ExclusionPath \"%TEMP%\nsfD374.tmp\""' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start --' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "powershell -command Add-MpPreference -ExclusionPath \"%WINDIR%\TEMP\nst16A.tmp\""' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete --' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:64' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "powershell -command Add-MpPreference -ExclusionPath \"<Full path to file>\""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Add-MpPreference -ExclusionPath \"<Full path to file>\"
- '%WINDIR%\syswow64\cmd.exe' /c "powershell -command Add-MpPreference -ExclusionPath \"%TEMP%\nsfD374.tmp\""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Add-MpPreference -ExclusionPath \"%TEMP%\nsfD374.tmp\"
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"
- '%WINDIR%\syswow64\net.exe' start --
- '%WINDIR%\syswow64\net1.exe' start --
- '%WINDIR%\syswow64\cmd.exe' /c "powershell -command Add-MpPreference -ExclusionPath \"%WINDIR%\TEMP\nst16A.tmp\""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Add-MpPreference -ExclusionPath \"%WINDIR%\TEMP\nst16A.tmp\"
- '%WINDIR%\syswow64\sc.exe' delete --
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:32
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f /reg:64
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:32
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f /reg:64
