Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ServiceDLL' = '%APPDATA%\qCavZJA6\presentationhost.exe'
Modifies file system
Creates the following files
- %TEMP%\nsl13aa.tmp\blowfish.dll
- %TEMP%\gkzldywrwfgkzldywrwfahde.ps1
- %TEMP%\nsl13aa.tmp\system.dll
- %HOMEPATH%\downloads\gkzldywrwf.vbs
- %APPDATA%\qcavzja6\presentationhost.exe
- %APPDATA%\qcavzja6\client32.ini
- %APPDATA%\qcavzja6\htctl32.dll
- %APPDATA%\qcavzja6\msvcr100.dll
- %APPDATA%\qcavzja6\nskbfltr.inf
- %APPDATA%\qcavzja6\nsm.ini
- %APPDATA%\qcavzja6\nsm.lic
- %APPDATA%\qcavzja6\pcicapi.dll
- %APPDATA%\qcavzja6\pcichek.dll
- %APPDATA%\qcavzja6\pcicl32.dll
- %APPDATA%\qcavzja6\remcmdstub.exe
- %APPDATA%\qcavzja6\tcctl32.dll
Deletes the following files
- %TEMP%\nsl13aa.tmp\blowfish.dll
- %TEMP%\nsl13aa.tmp\system.dll
- %HOMEPATH%\downloads\gkzldywrwf.vbs
Network activity
Connects to
- '18#.#63.45.181':443
UDP
- DNS ASK ge#.####upportsoftware.com
Miscellaneous
Searches for the following windows
- ClassName: 'NSMWClass' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %HOMEPATH%\downloads\GKZLDYWRWF.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1
- '%APPDATA%\qcavzja6\presentationhost.exe'
- '<SYSTEM32>\cmd.exe' /k echo CreateObject("Wscript.Shell").Run "cmd /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1", 0, False > %userprofile%\downloads\GKZLDYWRWF.vbs& wscript %userpr...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /k echo CreateObject("Wscript.Shell").Run "cmd /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1", 0, False > %userprofile%\downloads\GKZLDYWRWF.vbs& wscript %userpr...
- '<SYSTEM32>\cmd.exe' /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1
- '<SYSTEM32>\cmd.exe' /c cmd /c powershell -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1
- '<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\GKZLDYWRWFGKZLDYWRWFahde.ps1
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ServiceDLL /t REG_SZ /d %APPDATA%\qCavZJA6\presentationhost.exe /f
