Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\NetworkAgent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NetworkAgent] 'ImagePath' = '%WINDIR%\SysWOW64\wwtask.exe -service'
- [<HKLM>\System\CurrentControlSet\Services\Tz0FF] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\Tz0FF] 'ImagePath' = 'system32\DRIVERS\Tz0FF.sys'
- [<HKLM>\System\CurrentControlSet\Services\AwtaskService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AwtaskService] 'ImagePath' = '%WINDIR%\NetworkClient\API\awtask.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Tz0HookInjectionDriver] 'ImagePath' = '%WINDIR%\NetworkClient\Driver\awtask64.sys'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\t0vnc.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\t0rc.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\wwtask.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NetworkClient' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\Tz0FF.sys' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\Tz0Otfe.sys' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\Tz0OTFESB.sys' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Processes] 'wwtask.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Processes] 'awtask.exe' = '00000000'
Injects code into
the following system processes:
- <SYSTEM32>\dwm.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %WINDIR%\networkclient\cfg\core.cfg
- %WINDIR%\networkclient\data\tz0awt.dat
- %WINDIR%\networkclient\library\awtask64.dll
- %WINDIR%\networkclient\driver\awtask64.sys
- %WINDIR%\networkclient\library\awtask32.dll
- %WINDIR%\temp\udd7dbd.tmp
- %WINDIR%\networkclient\cfg\guard.cfg
- %WINDIR%\networkclient\cfg\perf.cfg
- %WINDIR%\networkclient\library\tz0input.dll
- <DRIVERS>\tz0ff.sys
- %WINDIR%\networkclient\library\tz0ff64.dll
- %WINDIR%\networkclient\library\tz0ff32.dll
- %WINDIR%\networkclient\api\awtask.exe
- %WINDIR%\networkclient\data\tz0deb.data
- %WINDIR%\networkclient\data\tz0adv.data
- %WINDIR%\networkclient\cfg\dbsec.cfg
- %WINDIR%\networkclient\cfg\cert.cfg
- %WINDIR%\syswow64\wwtask.exe
- %WINDIR%\networkclient\data\tz0act.data
- %WINDIR%\networkclient\cfg\bclog.cfg
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\wwtask.exe
Deletes the following files
- %WINDIR%\temp\udd7dbd.tmp
- %WINDIR%\networkclient\data\tz0awt.dat
Network activity
Connects to
- '<LOCALNET>.100.10':770
- 'al##te.com':80
- '<LOCALNET>.100.10':81
- '<LOCALNET>.100.10':700
UDP
- DNS ASK al##te.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Program Manager'
Creates and executes the following
- '%WINDIR%\syswow64\wwtask.exe' -service
- '%WINDIR%\syswow64\wwtask.exe' nn
- '%WINDIR%\networkclient\api\awtask.exe' /install /silent
- '%WINDIR%\networkclient\api\awtask.exe'
- '%WINDIR%\syswow64\wwtask.exe' nn' (with hidden window)
- '%WINDIR%\networkclient\api\awtask.exe' /install /silent' (with hidden window)
