Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Wiyrsouq' = 'regsvr32.exe /s %APPDATA%\Anikg\giybruy.dll'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' HZLPoPa.dll,DllRegisterServer
Injects code into
the following system processes:
- %WINDIR%\syswow64\msiexec.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKLM>\Software\Microsoft\Internet Account Manager]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\deat.tmp
- %TEMP%\vixe.tmp
- %TEMP%\myumoqq.tmp
- %TEMP%\comiusa.tmp
- %TEMP%\xianizpu.tmp
- %TEMP%\poduibh.tmp
- %TEMP%\cyodrida.tmp
- %TEMP%\biace.tmp
- %TEMP%\zomuana.tmp
- %TEMP%\emqume.tmp
- %TEMP%\amidti.tmp
- %TEMP%\huafre.tmp
- %TEMP%\muomtuka.tmp
- %TEMP%\siquapz.tmp
- %TEMP%\xaroag.tmp
- %TEMP%\qesake.tmp
- %TEMP%\soewhoy.tmp
- %TEMP%\abboy.tmp
- %TEMP%\ehqu.tmp
- %APPDATA%\itysom\ynsa.ec
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- C:\msdownld.tmp\as11b11d.tmp\tsk.dll
- %HOMEPATH%\documents\hzlpopa.dll
- %APPDATA%\anikg\giybruy.dll
- %APPDATA%\reisw\liviurco.mioki
- %APPDATA%\zever\ycekwo.ive
- %APPDATA%\yqizac\onobmiu.fot
- %APPDATA%\baodpe\azdomos.ageb
- %TEMP%\hayz.tmp
- %APPDATA%\nypiih\qeivma.xuaq
- %TEMP%\qytuuv.tmp
- %APPDATA%\zever\ycekwo.tmp
- %TEMP%\laygezh.tmp
- %TEMP%\hebu.tmp
- %TEMP%\hebu.tmp-shm
- %TEMP%\oqniuka.tmp
- %TEMP%\yfaghego.tmp
- %APPDATA%\orafew\ysrepeho.agboi
Deletes the following files
- C:\msdownld.tmp\as11b11d.tmp\tsk.dll
- %TEMP%\qesake.tmp
- %TEMP%\xaroag.tmp
- %TEMP%\siquapz.tmp
- %TEMP%\muomtuka.tmp
- %TEMP%\huafre.tmp
- %TEMP%\amidti.tmp
- %TEMP%\emqume.tmp
- %TEMP%\biace.tmp
- %TEMP%\abboy.tmp
- %TEMP%\cyodrida.tmp
- %TEMP%\poduibh.tmp
- %TEMP%\xianizpu.tmp
- %TEMP%\comiusa.tmp
- %TEMP%\myumoqq.tmp
- %TEMP%\vixe.tmp
- %TEMP%\deat.tmp
- %TEMP%\soewhoy.tmp
- %TEMP%\ehqu.tmp
- %TEMP%\yfaghego.tmp
- %TEMP%\hayz.tmp
- %TEMP%\oqniuka.tmp
- %TEMP%\hebu.tmp
- %TEMP%\hebu.tmp-shm
- %TEMP%\laygezh.tmp
- %TEMP%\qytuuv.tmp
- %TEMP%\zomuana.tmp
- %APPDATA%\zever\ycekwo.tmp
Moves the following files
- from %APPDATA%\zever\ycekwo.ive to %APPDATA%\zever\ycekwo.tmp
Substitutes the following files
- %APPDATA%\zever\ycekwo.ive
- %APPDATA%\zever\ycekwo.tmp
Network activity
Connects to
- 'mi###anttra.at':443
TCP
- 'de###rena.at':443
UDP
- DNS ASK de###rena.at
- DNS ASK mi###anttra.at
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' HZLPoPa.dll,DllRegisterServer' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net config workstation' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net view /all' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '%WINDIR%\syswow64\cmd.exe' /c net config workstation
- '%WINDIR%\syswow64\net.exe' config workstation
- '%WINDIR%\syswow64\net1.exe' config workstation
- '%WINDIR%\syswow64\cmd.exe' /c net view /all
- '%WINDIR%\syswow64\net.exe' view /all
