Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updaten
- <SYSTEM32>\tasks\updater
Malicious functions
Downloads and executes
- https://3.top4top.net/p_1349kvnul1.jpg as \$env:appdata\updaten\spoolsvs.exe\
- https://1.top4top.net/p_1357dcqww1.jpg as \$env:appdata\updater\spools.exe\
Modifies file system
Creates the following files
- %TEMP%\Г©osya1.txt
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagestrings[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\errorpagetemplate[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\navcancl[1]
- <LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019101020191011\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dnserrordiagoff_weboc[1]
- %TEMP%\client.exe
- %TEMP%\tmpbe36.tmp.bat
- %TEMP%\scmvc.exe
- %TEMP%\Г©osya2.txt
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]
- %TEMP%\tmpd3ae.tmp.bat
Deletes the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
- %TEMP%\tmpbe36.tmp.bat
- %TEMP%\tmpd3ae.tmp.bat
Network activity
UDP
- DNS ASK fa###ook.com
- DNS ASK 3.###4top.net
- DNS ASK 1.###4top.net
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\scmvc.exe'
- '%TEMP%\client.exe'
- '%TEMP%\scmvc.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmpBE36.tmp.bat" "' (with hidden window)
- '%TEMP%\client.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmpD3AE.tmp.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmpBE36.tmp.bat" "
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "Updaten" /TR "%APPDATA%\updaten\spoolsvs.exe"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmpD3AE.tmp.bat" "
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "Updater" /TR "%APPDATA%\updater\spools.exe"
- '<SYSTEM32>\taskeng.exe' {FA588364-9AC5-4E24-9608-FE39C99409F5} S-1-5-21-1960123792-2022915161-3775307078-1001:dujsglhrhfsl\user:Interactive:[1]
