Trojan.BtcMine.344

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sv.exe' = '%TEMP%\sv.exe\sv.exe.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'Debugger' = 'nsjw.exe'
[<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows COM Host' = 'C:\{$8975-4932-7241-6744$}\sv.exe -rundll32 /SYSTEM32 "<SYSTEM32>\taskmgr.exe" "%ProgramFiles%\Microsoft...
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = 'C:\{$8975-4932-7241-6744$}\sv.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '<Full path to file>'
[<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows COM Host' = '<Full path to file> -rundll32 /SYSTEM32 "<SYSTEM32>\taskmgr.exe" "%ProgramFiles%\Microsoft\Windows"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\sv.exe.url

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

blocks the following features:

System Restore (SR)

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\cmd.exe

Modifies file system

Creates the following files

%TEMP%\sv.exe\sv.exe.exe
C:\{$8975-4932-7241-6744$}\sv.exe
%PROGRAMDATA%\898191165.exe
%PROGRAMDATA%\898191165.vbs

Sets the 'hidden' attribute to the following files

C:\{$8975-4932-7241-6744$}\sv.exe
<Full path to file>
%PROGRAMDATA%\898191165.exe

Deletes the following files

%WINDIR%\syswow64\useraccountcontrolsettings.exe
%PROGRAMDATA%\898191165.vbs

Substitutes the following files

%PROGRAMDATA%\898191165.vbs

Network activity

UDP

DNS ASK 4l####5tc.zapto.org

Miscellaneous

Creates and executes the following

'C:\{$8975-4932-7241-6744$}\sv.exe'
'%WINDIR%\syswow64\wscript.exe' "%PROGRAMDATA%\898191165.vbs"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\UserAccountControlSettings.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "%PROGRAMDATA%\898191165.vbs"' (with hidden window)

Executes the following