Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd3dx32' = 'C:\Med\System.lnk'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\bkphst32.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\winlog.lnk
Modifies file system
Creates the following files
- C:\med\yzwimkoliaoipjfpeck3.exe
- C:\med\3hvrlhokayb0lhcgdsl7d9gx4t0mcu.vbs
- C:\med\njesm1lwf8xvmpynb7v9823w9yvfcg.bat
- C:\med\e6k5kv3ncxfcz1a1eum1mtkjsvqnwp.bat
- C:\med\vmcheck32.dll
- C:\med\fontreview.exe
- C:\med\system.vbe
- C:\med\system.lnk
- %HOMEPATH%\pictures\bkphst32.exe
- %HOMEPATH%\pictures\bkphst32.lnk
- %HOMEPATH%\pictures\vmcheck32.dll
- C:\med\winlog.lnk
Network activity
TCP
HTTP GET requests
- http://fa#######nul2.000webhostapp.com/cgamn345k66de12u4k9pnx9adt2wabox21xs7lffpb/5urmsvundcxjbnh7z1cy9/7eb0bd4382686df964bf102929593b7112eb6111.php?da#########
- http://fa#######nul2.000webhostapp.com/cgamn345k66de12u4k9pnx9adt2wabox21xs7lffpb/5urmsvundcxjbnh7z1cy9/igo73/009b2ad08a0a0eff4cab24cc2f8fee97.php?ty############################################...
- http://fa#######nul2.000webhostapp.com/cgamn345k66de12u4k9pnx9adt2wabox21xs7lffpb/5urmsvundcxjbnh7z1cy9/igo73/f822f1da1abaf67438d4e7c512599feca9f154c1.ca7531b56ba8834fe55e8171d278c462
- http://fa#######nul2.000webhostapp.com/cgamn345k66de12u4k9pnx9adt2wabox21xs7lffpb/5urmsvundcxjbnh7z1cy9/igo73/f822f1da1abaf67438d4e7c512599feca9f154c1.09cb34d4e7d55da4f0a31dfb1b29c1c7
- http://fa#######nul2.000webhostapp.com/cgamn345k66de12u4k9pnx9adt2wabox21xs7lffpb/5urmsvundcxjbnh7z1cy9/igo73/f822f1da1abaf67438d4e7c512599feca9f154c1.comm
- http://ip##fo.io/ip
UDP
- DNS ASK fa#######nul2.000webhostapp.com
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\Med\3hVRlhokAYb0lhCGDSl7D9gX4t0MCU.vbs"
- 'C:\med\yzwimkoliaoipjfpeck3.exe' -p093b6654695330ccb6ca52e0acf157ddfc60133b
- '%WINDIR%\syswow64\wscript.exe' "C:\Med\System.vbe"
- 'C:\med\fontreview.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Med\NjeSm1lWf8XVmPynB7V9823W9Yvfcg.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Med\E6k5Kv3ncxfCz1a1EUM1mTKjSvQnWp.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Med\NjeSm1lWf8XVmPynB7V9823W9Yvfcg.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Med\E6k5Kv3ncxfCz1a1EUM1mTKjSvQnWp.bat" "
