Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\p-5-5-90-1223138316-1015961002-1377045167-8370\{r764tdqa-vh4z-raqd-ulwq-sekoua6l5i5g}
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wkhv7ncn\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ozj8svk4\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\j75589p8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\pnzq3v1o\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wkhv7ncn\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ozj8svk4\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\j75589p8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\pnzq3v1o\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Moves itself
- from <Full path to file> to %APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914\kbdrost.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ez##at.ru
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\wow64_windows-media-...' (with hidden window)
- '%APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914\kbdrost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\wow64_windows-media-...
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.18362.1_none_616a13f60904e914" /inheritance:e /deny "user:(R,REA,RA,RD)"
- '<SYSTEM32>\taskeng.exe' {C6EC1BA5-EF05-4728-BD32-38B5958D1544} S-1-5-21-1960123792-2022915161-3775307078-1001:nutkjyi\user:Interactive:[1]
