Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\z-3-7-92-1062859708-1399898078-1132345165-7794\{w1mdzslg-1urw-6qvq-6vy-wpsgo9vs7d4}
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\fb_7ab0.tmp.exe
- %TEMP%\fb_7cf3.tmp.exe
- %TEMP%\fb_7d90.tmp.exe
- %PROGRAMDATA%\mntemp
Sets the 'hidden' attribute to the following files
- %APPDATA%\certificates\sfxsv32.exe
Moves the following files
- from %TEMP%\fb_7d90.tmp.exe to %APPDATA%\certificates\sfxsv32.exe
Network activity
TCP
HTTP GET requests
- http://45.##.84.10:2012/websocket via 45.#2.84.10
Miscellaneous
Creates and executes the following
- '%TEMP%\fb_7ab0.tmp.exe'
- '%TEMP%\fb_7cf3.tmp.exe'
- '%TEMP%\fb_7d90.tmp.exe'
- '%APPDATA%\certificates\sfxsv32.exe'
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\Certificates" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\Certificates" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "%APPDATA%\Certificates...' (with hidden window)
- '%APPDATA%\certificates\sfxsv32.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\Certificates" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\Certificates" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "%APPDATA%\Certificates...
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\Certificates" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
- '<SYSTEM32>\taskeng.exe' {6261A5EB-FB82-4A2C-A6EB-B77D0BD372A1} S-1-5-21-1960123792-2022915161-3775307078-1001:qousnsqqfui\user:Interactive:[1]
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\Certificates" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\Certificates" /inheritance:e /deny "user:(R,REA,RA,RD)"
