Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'L2Schemas' = '%HOMEPATH%\DirectX\Google.com "%HOMEPATH%\DirectX\L2Schemas"'
Creates or modifies the following files
- <SYSTEM32>\tasks\directx
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Injects code into
the following system processes:
- %WINDIR%\syswow64\ctfmon.exe
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe
- %TEMP%\aut3039.tmp
- %HOMEPATH%\directx\controls
- %TEMP%\aut30c7.tmp
- %HOMEPATH%\directx\google.com
- %TEMP%\aut31a3.tmp
- %HOMEPATH%\directx\l2schemas
- %TEMP%\aut3211.tmp
- %HOMEPATH%\directx\2929303.vbe
- %TEMP%\zendopcache.memorybase@user
- %APPDATA%\microsoft\internet explorer\googleupdate.exe
- %HOMEPATH%\mru.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\<File name>.exe
- %HOMEPATH%\directx\controls
- %APPDATA%\microsoft\internet explorer\googleupdate.exe
- %HOMEPATH%\directx\2929303.vbe
- %HOMEPATH%\directx\google.com
- %HOMEPATH%\directx\l2schemas
Deletes the following files
- %TEMP%\aut3039.tmp
- %TEMP%\aut30c7.tmp
- %TEMP%\aut31a3.tmp
- %TEMP%\aut3211.tmp
- %APPDATA%\microsoft\internet explorer\googleupdate.exe
Network activity
UDP
- DNS ASK sy######dat60.dahuaddns.com
- DNS ASK mi######t.net.linkpc.net
- DNS ASK ne######service.myq-see.com
- DNS ASK ey####m.myq-see.com
Miscellaneous
Creates and executes the following
- '%TEMP%\<File name>.exe'
- '%TEMP%\<File name>.exe' -c "C:\php-cli.ini" "C:\vos.php"
- '%HOMEPATH%\directx\google.com' L2Schemas
- '%APPDATA%\microsoft\internet explorer\googleupdate.exe' "%HOMEPATH%\mru.dat"
- '%WINDIR%\syswow64\cmd.exe' /C cd %userprofile%\DirectX\ && PowerShell.exe Start-Process Google.com "L2Schemas" && Exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C copy /Y "%userprofile%\DirectX\Google.com" "%APPDATA%\Microsoft\Internet Explorer\GoogleUpdate.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /delete /tn DirectX /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /create /tn "DirectX" /tr "\"%userprofile%\DirectX\2929303.vbe"" /ru %username% /sc minute /mo 5' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C cd %userprofile%\DirectX\ && PowerShell.exe Start-Process Google.com "L2Schemas" && Exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Start-Process Google.com "L2Schemas"
- '%WINDIR%\syswow64\cmd.exe' /C copy /Y "%userprofile%\DirectX\Google.com" "%APPDATA%\Microsoft\Internet Explorer\GoogleUpdate.exe"
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /delete /tn DirectX /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn DirectX /f
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /create /tn "DirectX" /tr "\"%userprofile%\DirectX\2929303.vbe"" /ru %username% /sc minute /mo 5
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "DirectX" /tr "\"%HOMEPATH%\DirectX\2929303.vbe"" /ru user /sc minute /mo 5
- '%WINDIR%\syswow64\ctfmon.exe'
