Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '7a3bd16f6cced4425d805bd7cc0d437c' = '"<Current directory>\Wallpaper.scr" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '7a3bd16f6cced4425d805bd7cc0d437c' = '"<Current directory>\Wallpaper.scr" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\7a3bd16f6cced4425d805bd7cc0d437c.exe
- <SYSTEM32>\tasks\java
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "<Current directory>\Wallpaper.scr" "Wallpaper.scr" ENABLE
Modifies file system
Creates the following files
- <Current directory>\wallpaper.scr
- <Current directory>\ps4maxsavewizardcracked.exe
- <Current directory>\ps4saveeditor.exe
- %TEMP%\1\9c90.bat
- %WINDIR%\temp\windows-defender.exe
Sets the 'hidden' attribute to the following files
- <Current directory>\wallpaper.scr
- <Current directory>\ps4maxsavewizardcracked.exe
- <Current directory>\ps4saveeditor.exe
Deletes the following files
- %TEMP%\1\9c90.bat
Network activity
TCP
- 'drive.google.com':443
UDP
- DNS ASK do####dz.ddns.net
- DNS ASK drive.google.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<Current directory>\ps4maxsavewizardcracked.exe'
- '<Current directory>\wallpaper.scr' /S
- '<Current directory>\ps4saveeditor.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "<Current directory>\Wallpaper.scr" "Wallpaper.scr" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn Java /tr <Current directory>\Wallpaper.scr' (with hidden window)
- '<Current directory>\wallpa~1.scr' "<Current directory>\Wallpaper.scr"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\1\9C90.bat <Current directory>\PS4MAXSAVEWIZARDCRACKED.exe"
- '<SYSTEM32>\reg.exe' query "HKU\S-1-5-19\Environment"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn Java /tr <Current directory>\Wallpaper.scr
- '<SYSTEM32>\taskeng.exe' {4324FB1C-438F-4F92-8B2C-53E496601422} S-1-5-21-1960123792-2022915161-3775307078-1001:vmcajyhnys\user:Interactive:[1]
