Win32.HLLW.Autoruner2.63363

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\software\microsoft\windows\currentversion\run] 'xAnFyOtMjK' = 'wscript.exe //B "%APPDATA%\xAnFyOtMjK.js"'
[<HKLM>\software\microsoft\windows\currentversion\run] 'xAnFyOtMjK' = 'wscript.exe //B "%APPDATA%\xAnFyOtMjK.js"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'GYLHOsHgJWS' = '"%APPDATA%\Oracle\bin\javaw.exe" -jar "%HOMEPATH%\nSTFyWrVADL\hDPNXWKFnzS.WrBsVl"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\xanfyotmjk.js

Creates the following files on removable media

<Drive name for removable media>:\xanfyotmjk.js
<Drive name for removable media>:\samieee_obiee_presentation.lnk
<Drive name for removable media>:\middaugh_keynote.lnk
<Drive name for removable media>:\roozenedowebinar.lnk
<Drive name for removable media>:\gruenspecht_02172016.lnk
<Drive name for removable media>:\waterresourcesag.lnk
<Drive name for removable media>:\asaprojectcompetition.lnk
<Drive name for removable media>:\writingcompletesarnarrative_1103.lnk
<Drive name for removable media>:\proposaltemplates.lnk
<Drive name for removable media>:\metac.lnk
<Drive name for removable media>:\ksearch_esa_talk.lnk
<Drive name for removable media>:\accountsreceivable.lnk
<Drive name for removable media>:\arrow-down.lnk
<Drive name for removable media>:\asm.lnk
<Drive name for removable media>:\background.lnk
<Drive name for removable media>:\hhhlcert.lnk
<Drive name for removable media>:\tunpersonalca1.lnk
<Drive name for removable media>:\irgeek.lnk
<Drive name for removable media>:\server.lnk
<Drive name for removable media>:\ck_ugo.lnk
<Drive name for removable media>:\ff_ot_user_guide.lnk
<Drive name for removable media>:\7790_preview.lnk
<Drive name for removable media>:\spib_pima.lnk
<Drive name for removable media>:\bc01.lnk
<Drive name for removable media>:\foaf.lnk
<Drive name for removable media>:\contenttypes.lnk
<Drive name for removable media>:\1sm_price.lnk
<Drive name for removable media>:\schema.lnk
<Drive name for removable media>:\productos.lnk
<Drive name for removable media>:\fiche_inscription_2015.lnk
<Drive name for removable media>:\national_autism_preparation_programs.lnk
<Drive name for removable media>:\trtf_matrix2012_oct.lnk
<Drive name for removable media>:\2013_finalsummaryforweb.lnk
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.lnk
<Drive name for removable media>:\applicant.lnk
<Drive name for removable media>:\suspendedcompanies.lnk
<Drive name for removable media>:\highly_cited_2001.lnk
<Drive name for removable media>:\guide_reorganization_mapping.lnk
<Drive name for removable media>:\excel_example.lnk
<Drive name for removable media>:\price030215.lnk
<Drive name for removable media>:\flower_trans_matte.lnk
<Drive name for removable media>:\babyboymaintonotesbackground_pal.lnk
<Drive name for removable media>:\waterlandhealthkano.lnk
<Drive name for removable media>:\phytoremediation.lnk
<Drive name for removable media>:\military_callsigns_0311.lnk
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.lnk
<Drive name for removable media>:\pandp.lnk
<Drive name for removable media>:\myhrvoldhanssenbiharfamine.lnk
<Drive name for removable media>:\swc_2009-03-02.lnk
<Drive name for removable media>:\20140114.lnk
<Drive name for removable media>:\elvisimp.lnk
<Drive name for removable media>:\fil_20060629111052.lnk
<Drive name for removable media>:\digest.lnk
<Drive name for removable media>:\lom602.lnk
<Drive name for removable media>:\holycrosschurchinstructions.lnk
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.lnk
<Drive name for removable media>:\lisp_success.lnk
<Drive name for removable media>:\february_catalogue__2015.lnk
<Drive name for removable media>:\weeklysheet1215.lnk
<Drive name for removable media>:\hanni_umami_chapter.lnk
<Drive name for removable media>:\508softwareandos.lnk
<Drive name for removable media>:\sdksampleunprivdeveloper.lnk
<Drive name for removable media>:\contosoroot.lnk
<Drive name for removable media>:\testcertificate.lnk
<Drive name for removable media>:\sdksampleprivdeveloper.lnk
<Drive name for removable media>:\contosoroot_1.lnk
<Drive name for removable media>:\dial.lnk
<Drive name for removable media>:\dashborder_96.lnk
<Drive name for removable media>:\default.lnk
<Drive name for removable media>:\dashborder_192.lnk
<Drive name for removable media>:\tileimage.lnk
<Drive name for removable media>:\dashborder_144.lnk
<Drive name for removable media>:\coffee.lnk
<Drive name for removable media>:\dashborder_120.lnk
<Drive name for removable media>:\dialmap.lnk
<Drive name for removable media>:\correct.lnk
<Drive name for removable media>:\000814251_video_01.lnk
<Drive name for removable media>:\join.lnk
<Drive name for removable media>:\file_p_00000000_1371597592.lnk
<Drive name for removable media>:\aoc_saq_d_v3_merchant.lnk
<Drive name for removable media>:\video.lnk
<Drive name for removable media>:\glidescope_review_rev_010.lnk
<Drive name for removable media>:\51.lnk
<Drive name for removable media>:\etc6_m_1.lnk
<Drive name for removable media>:\spanner.lnk
<Drive name for removable media>:\210252809.lnk
<Drive name for removable media>:\168.lnk
<Drive name for removable media>:\parnas_01.lnk
<Drive name for removable media>:\13.lnk
<Drive name for removable media>:\1189.lnk
<Drive name for removable media>:\3.lnk
<Drive name for removable media>:\2.lnk
<Drive name for removable media>:\4f0bf7ff71f28.lnk
<Drive name for removable media>:\alert.lnk
<Drive name for removable media>:\garden.lnk
<Drive name for removable media>:\iisstart.lnk
<Drive name for removable media>:\advice_process.lnk
<Drive name for removable media>:\ituneshelpunavailable.lnk
<Drive name for removable media>:\tree_view.lnk
<Drive name for removable media>:\trivial-merge.lnk
<Drive name for removable media>:\chromesetup.lnk
<Drive name for removable media>:\calc.lnk
<Drive name for removable media>:\skypesetup.lnk
<Drive name for removable media>:\dotnetfx45_full_setup.lnk
<Drive name for removable media>:\notepad.lnk
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.lnk
<Drive name for removable media>:\contractualdeadlines.lnk

Malicious functions

Creates and executes the following

'%APPDATA%\oracle\bin\javaw.exe' -jar %HOMEPATH%\nSTFyWrVADL\hDPNXWKFnzS.WrBsVl
'%APPDATA%\oracle\bin\java.exe' -jar %TEMP%\_0.2921183381301383947108071950880353.class

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe
<SYSTEM32>\xcopy.exe

Modifies file system

Creates the following files

%APPDATA%\xanfyotmjk.js
%APPDATA%\oracle\lib\tzmappings
%APPDATA%\oracle\lib\amd64\jvm.cfg
%APPDATA%\oracle\lib\cmm\ciexyz.pf
%APPDATA%\oracle\lib\cmm\gray.pf
%APPDATA%\oracle\lib\cmm\linear_rgb.pf
%APPDATA%\oracle\lib\cmm\pycc.pf
%APPDATA%\oracle\lib\cmm\srgb.pf
%APPDATA%\oracle\lib\deploy\ffjcext.zip
%APPDATA%\oracle\lib\deploy\messages.properties
%APPDATA%\oracle\lib\sound.properties
%APPDATA%\oracle\lib\tzdb.dat
%APPDATA%\oracle\lib\deploy\messages_de.properties
%APPDATA%\oracle\lib\deploy\messages_it.properties
%APPDATA%\oracle\lib\deploy\messages_ja.properties
%APPDATA%\oracle\lib\deploy\messages_ko.properties
%APPDATA%\oracle\lib\deploy\messages_pt_br.properties
%APPDATA%\oracle\lib\deploy\messages_sv.properties
%APPDATA%\oracle\lib\deploy\messages_zh_cn.properties
%APPDATA%\oracle\lib\deploy\messages_zh_hk.properties
%APPDATA%\oracle\lib\deploy\messages_zh_tw.properties
%APPDATA%\oracle\lib\deploy\splash.gif
%APPDATA%\oracle\lib\deploy\messages_es.properties
%APPDATA%\oracle\lib\deploy\messages_fr.properties
%APPDATA%\oracle\lib\ext\access-bridge-64.jar
%APPDATA%\oracle\lib\deploy\splash@2x.gif
%APPDATA%\oracle\lib\psfontj2d.properties
%APPDATA%\oracle\lib\content-types.properties
%APPDATA%\oracle\lib\currency.data
%APPDATA%\oracle\lib\deploy.jar
%APPDATA%\oracle\lib\flavormap.properties
%APPDATA%\oracle\lib\fontconfig.bfc
%APPDATA%\oracle\lib\fontconfig.properties.src
%APPDATA%\oracle\lib\hijrah-config-umalqura.properties
%APPDATA%\oracle\lib\javafx.properties
%APPDATA%\oracle\lib\resources.jar
%APPDATA%\oracle\lib\charsets.jar
%APPDATA%\oracle\lib\rt.jar
%APPDATA%\oracle\lib\javaws.jar
%APPDATA%\oracle\lib\jsse.jar
%APPDATA%\oracle\lib\jvm.hprof.txt
%APPDATA%\oracle\lib\logging.properties
%APPDATA%\oracle\lib\management-agent.jar
%APPDATA%\oracle\lib\meta-index
%APPDATA%\oracle\lib\net.properties
%APPDATA%\oracle\lib\plugin.jar
%APPDATA%\oracle\lib\psfont.properties.ja
%APPDATA%\oracle\lib\jce.jar
%APPDATA%\oracle\lib\jfr.jar
%APPDATA%\oracle\lib\jfxswt.jar
%APPDATA%\oracle\bin\jli.dll
%APPDATA%\oracle\lib\ext\cldrdata.jar
%APPDATA%\oracle\lib\jfr\profile.jfc
%APPDATA%\oracle\lib\management\jmxremote.password.template
%APPDATA%\oracle\lib\management\management.properties
%APPDATA%\oracle\lib\management\snmp.acl.template
%APPDATA%\oracle\lib\security\blacklist
%APPDATA%\oracle\lib\security\blacklisted.certs
%APPDATA%\oracle\lib\security\cacerts
%APPDATA%\oracle\lib\security\java.policy
%APPDATA%\oracle\lib\security\java.security
%APPDATA%\oracle\lib\jfr\default.jfc
%APPDATA%\oracle\lib\security\javaws.policy
%APPDATA%\oracle\lib\management\jmxremote.access
%APPDATA%\oracle\lib\security\us_export_policy.jar
%HOMEPATH%\nstfywrvadl\id.txt
%HOMEPATH%\nstfywrvadl\hdpnxwkfnzs.wrbsvl
%TEMP%\hsperfdata_user\168
%TEMP%\_0.2921183381301383947108071950880353.class
%TEMP%\hsperfdata_user\2252
%TEMP%\retrive7981765638354351412.vbs
%TEMP%\retrive2242030816864338611.vbs
%TEMP%\retrive1200079007196098254.vbs
%APPDATA%\oracle\lib\security\local_policy.jar
%APPDATA%\oracle\lib\images\cursors\win32_movenodrop32x32.gif
<SYSTEM32>\test.txt
%APPDATA%\oracle\lib\images\cursors\win32_movedrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_linknodrop32x32.gif
%APPDATA%\oracle\lib\ext\jaccess.jar
%APPDATA%\oracle\lib\ext\localedata.jar
%APPDATA%\oracle\lib\ext\meta-index
%APPDATA%\oracle\lib\ext\nashorn.jar
%APPDATA%\oracle\lib\ext\sunec.jar
%APPDATA%\oracle\lib\ext\sunjce_provider.jar
%APPDATA%\oracle\lib\ext\sunmscapi.jar
%APPDATA%\oracle\lib\ext\sunpkcs11.jar
%APPDATA%\oracle\lib\ext\zipfs.jar
%APPDATA%\oracle\lib\fonts\lucidabrightdemibold.ttf
%APPDATA%\oracle\lib\fonts\lucidabrightdemiitalic.ttf
%APPDATA%\oracle\lib\ext\jfxrt.jar
%APPDATA%\oracle\lib\fonts\lucidabrightitalic.ttf
%APPDATA%\oracle\lib\fonts\lucidasansdemibold.ttf
%APPDATA%\oracle\lib\fonts\lucidasansregular.ttf
%APPDATA%\oracle\lib\fonts\lucidatypewriterbold.ttf
%APPDATA%\oracle\lib\fonts\lucidatypewriterregular.ttf
%APPDATA%\oracle\lib\images\cursors\cursors.properties
%APPDATA%\oracle\lib\images\cursors\invalid32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_copydrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_copynodrop32x32.gif
%APPDATA%\oracle\lib\images\cursors\win32_linkdrop32x32.gif
%APPDATA%\oracle\lib\calendars.properties
%APPDATA%\oracle\lib\fonts\lucidabrightregular.ttf
%APPDATA%\oracle\lib\classlist
%APPDATA%\oracle\lib\accessibility.properties
%APPDATA%\oracle\bin\server\xusage.txt
%APPDATA%\oracle\bin\server\jvm.dll
%APPDATA%\oracle\bin\j2pkcs11.dll
%APPDATA%\oracle\bin\jaas_nt.dll
%APPDATA%\oracle\bin\jabswitch.exe
%APPDATA%\oracle\bin\java-rmi.exe
%APPDATA%\oracle\bin\java.dll
%APPDATA%\oracle\bin\java.exe
%APPDATA%\oracle\bin\javaaccessbridge-64.dll
%APPDATA%\oracle\bin\javacpl.cpl
%APPDATA%\oracle\bin\hprof.dll
%APPDATA%\oracle\bin\glib-lite.dll
%APPDATA%\oracle\bin\j2pcsc.dll
%APPDATA%\oracle\bin\javacpl.exe
%APPDATA%\oracle\bin\javaw.exe
%APPDATA%\oracle\bin\javaws.exe
%APPDATA%\oracle\bin\java_crw_demo.dll
%APPDATA%\oracle\bin\jawt.dll
%APPDATA%\oracle\bin\jawtaccessbridge-64.dll
%APPDATA%\oracle\bin\jdwp.dll
%APPDATA%\oracle\bin\jfr.dll
%APPDATA%\oracle\bin\jfxmedia.dll
%APPDATA%\oracle\bin\javafx_font.dll
%APPDATA%\oracle\bin\javafx_font_t2k.dll
%APPDATA%\oracle\bin\javafx_iio.dll
%APPDATA%\oracle\bin\gstreamer-lite.dll
%APPDATA%\oracle\bin\glass.dll
%APPDATA%\oracle\bin\jfxwebkit.dll
%TEMP%\_0.5811992259652935494217804957452892.class
%TEMP%\retrive5128761380690297229.vbs
%TEMP%\retrive2863375705491538398.vbs
%TEMP%\retrive8552391875935346259.vbs
%TEMP%\retrive5852637663930763684.vbs
%APPDATA%\oracle\copyright
%APPDATA%\oracle\license
%APPDATA%\oracle\readme.txt
%APPDATA%\oracle\release
%APPDATA%\oracle\thirdpartylicensereadme-javafx.txt
%APPDATA%\dlxgrrxy.txt
%APPDATA%\oracle\thirdpartylicensereadme.txt
%APPDATA%\oracle\bin\awt.dll
%APPDATA%\oracle\bin\bci.dll
%APPDATA%\oracle\bin\dcpr.dll
%APPDATA%\oracle\bin\decora_sse.dll
%APPDATA%\oracle\bin\deploy.dll
%APPDATA%\oracle\bin\dt_shmem.dll
%APPDATA%\oracle\bin\dt_socket.dll
%APPDATA%\oracle\bin\eula.dll
%APPDATA%\oracle\bin\fontmanager.dll
%APPDATA%\oracle\bin\fxplugins.dll
%APPDATA%\oracle\welcome.html
%HOMEPATH%\futkaleatxm\id.txt
%APPDATA%\oracle\lib\ext\dnsns.jar
%APPDATA%\oracle\bin\jjs.exe
%APPDATA%\oracle\bin\jp2native.dll
%APPDATA%\oracle\bin\servertool.exe
%APPDATA%\oracle\bin\splashscreen.dll
%APPDATA%\oracle\bin\ssv.dll
%APPDATA%\oracle\bin\ssvagent.exe
%APPDATA%\oracle\bin\sunec.dll
%APPDATA%\oracle\bin\sunmscapi.dll
%APPDATA%\oracle\bin\t2k.dll
%APPDATA%\oracle\bin\tnameserv.exe
%APPDATA%\oracle\bin\resource.dll
%APPDATA%\oracle\bin\unpack.dll
%APPDATA%\oracle\bin\rmiregistry.exe
%APPDATA%\oracle\bin\verify.dll
%APPDATA%\oracle\bin\windowsaccessbridge-64.dll
%APPDATA%\oracle\bin\wsdetect.dll
%APPDATA%\oracle\bin\zip.dll
%APPDATA%\oracle\bin\dtplugin\deployjava1.dll
%APPDATA%\oracle\bin\dtplugin\npdeployjava1.dll
%APPDATA%\oracle\bin\plugin2\msvcr100.dll
%APPDATA%\oracle\bin\plugin2\npjp2.dll
%APPDATA%\oracle\bin\server\classes.jsa
%APPDATA%\oracle\bin\unpack200.exe
%APPDATA%\oracle\bin\instrument.dll
%APPDATA%\oracle\bin\w2k_lsa_auth.dll
%APPDATA%\oracle\bin\rmid.exe
%APPDATA%\oracle\bin\prism_sw.dll
%APPDATA%\oracle\bin\prism_es2.dll
%APPDATA%\oracle\bin\jp2ssv.dll
%APPDATA%\oracle\bin\jpeg.dll
%APPDATA%\oracle\bin\jsdt.dll
%APPDATA%\oracle\bin\jsound.dll
%APPDATA%\oracle\bin\jsoundds.dll
%APPDATA%\oracle\bin\kcms.dll
%APPDATA%\oracle\bin\keytool.exe
%APPDATA%\oracle\bin\kinit.exe
%APPDATA%\oracle\bin\klist.exe
%APPDATA%\oracle\bin\jp2launcher.exe
%APPDATA%\oracle\bin\ktab.exe
%APPDATA%\oracle\bin\management.dll
%APPDATA%\oracle\bin\mlib_image.dll
%APPDATA%\oracle\bin\msvcr100.dll
%APPDATA%\oracle\bin\net.dll
%APPDATA%\oracle\bin\nio.dll
%APPDATA%\oracle\bin\npt.dll
%APPDATA%\oracle\bin\orbd.exe
%APPDATA%\oracle\bin\pack200.exe
%APPDATA%\oracle\bin\policytool.exe
%APPDATA%\oracle\bin\prism_common.dll
%APPDATA%\oracle\bin\lcms.dll
%APPDATA%\oracle\bin\prism_d3d.dll
%APPDATA%\oracle\bin\jp2iexp.dll
%TEMP%\retrive9041920855076066143.vbs

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\xanfyotmjk.js
%HOMEPATH%\nstfywrvadl\hdpnxwkfnzs.wrbsvl
%HOMEPATH%\nstfywrvadl\id.txt

Deletes the following files

%TEMP%\retrive5128761380690297229.vbs
%TEMP%\retrive2863375705491538398.vbs
%TEMP%\retrive8552391875935346259.vbs
%TEMP%\retrive5852637663930763684.vbs
%TEMP%\retrive2242030816864338611.vbs
%TEMP%\retrive1200079007196098254.vbs
%TEMP%\retrive7981765638354351412.vbs
%TEMP%\retrive9041920855076066143.vbs

Network activity

UDP

DNS ASK pl#####rv1.duckdns.org

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' "%APPDATA%\xAnFyOtMjK.js"
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive5128761380690297229.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive2863375705491538398.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive8552391875935346259.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive5852637663930763684.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive7981765638354351412.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive2242030816864338611.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive1200079007196098254.vbs
'<SYSTEM32>\cscript.exe' %TEMP%\Retrive9041920855076066143.vbs

Executes the following

'%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%APPDATA%\dlxgrrxy.txt"
'%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar %TEMP%\_0.5811992259652935494217804957452892.class
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive5128761380690297229.vbs
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive2863375705491538398.vbs
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive8552391875935346259.vbs
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive5852637663930763684.vbs
'<SYSTEM32>\xcopy.exe' "%ProgramFiles%\Java\jre1.8.0_45" "%APPDATA%\Oracle\" /e
'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GYLHOsHgJWS /t REG_EXPAND_SZ /d "\"%APPDATA%\Oracle\bin\javaw.exe\" -jar \"%HOMEPATH%\nSTFyWrVADL\hDPNXWKFnzS.WrBsVl\"" /f
'<SYSTEM32>\attrib.exe' +h "%HOMEPATH%\nSTFyWrVADL\*.*"
'<SYSTEM32>\attrib.exe' +h "%HOMEPATH%\nSTFyWrVADL"
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive7981765638354351412.vbs
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive2242030816864338611.vbs
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive1200079007196098254.vbs
'<SYSTEM32>\cmd.exe' /C cscript.exe %TEMP%\Retrive9041920855076066143.vbs

Технології

Терміни

Навчання

Міфи

Technical Information