Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\k-7-1-50-1137428111-1073493613-1138739865-9270\{qbgnrik-srbu-ccmf-l1to-d2shapb6cbc}
Modifies file system
Creates the following files
- %TEMP%\cdgh.exe
- %TEMP%\xxmbk.exe
- %APPDATA%\ssjk.exe
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\x03jqpfp\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\msno4q62\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\0ty0fxp6\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\wrpyl86e\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0\mfc100chs.exe
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\x03jqpfp\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\msno4q62\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\0ty0fxp6\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\wrpyl86e\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %TEMP%\xxmbk.exe
Moves the following files
- from %APPDATA%\ssjk.exe to %APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0\mfc100chs.exe
Network activity
UDP
- DNS ASK 02#p.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\xxmbk.exe' -s -pfsdgsdfvsdzcxfsDC
- '%APPDATA%\ssjk.exe'
- '%TEMP%\cdgh.exe'
- '%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0\mfc100chs.exe'
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\amd64_micros...' (with hidden window)
- '%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0\mfc100chs.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\amd64_micros...
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.18362.1_zh-cn_b8267d3d7728f8d0" /inheritance:e /deny "user:(R,REA,RA,RD)"
- '<SYSTEM32>\taskeng.exe' {000586CA-261A-4DD7-A246-5F404D13F28E} S-1-5-21-1960123792-2022915161-3775307078-1001:bxepltqefeyb\user:Interactive:[1]
