Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\tmp4c99.tmp
- %APPDATA%\opera software\opera stable\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\icon_32.png
- %APPDATA%\opera software\opera stable\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\icon_16.png
- %LOCALAPPDATA%\yandex\yandexbrowser\user data\default\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\icon_64.png
- %APPDATA%\opera software\opera stable\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\icon_64.png
- %TEMP%\tmp70fe.tmp
- %APPDATA%\micron\grouppolicy\gpt.ini
- %APPDATA%\micron\grouppolicy\user\registry.pol
- %TEMP%\tmp5217.tmp
- %TEMP%\tmpa2c9.tmp
- %TEMP%\tmpa2ca.tmp
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %WINDIR%\syswow64\grouppolicy\machine\registry.pol
- %WINDIR%\syswow64\grouppolicy\user\registry.pol
- %TEMP%\tmpb7f0.tmp
- %APPDATA%\opera software\opera stable\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\manifest.json
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\helper@helper\icon.png
- %APPDATA%\opera software\opera stable\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\home.js
- %LOCALAPPDATA%\yandex\yandexbrowser\user data\default\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\icon_16.png
- %LOCALAPPDATA%\yandex\yandexbrowser\user data\default\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\icon_32.png
- %LOCALAPPDATA%\yandex\yandexbrowser\user data\default\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\manifest.json
- %LOCALAPPDATA%\yandex\yandexbrowser\user data\default\extensions\dojgfgknadakhfnaogaipdbdamepeffe\0.9.3_0\home.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\helper@helper\install.rdf
- %TEMP%\tmp52a5.tmp
- %APPDATA%\micron\grouppolicy\machine\registry.pol
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\helper@helper\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\helper@helper\chrome\content\linktargetfinder.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\helper@helper\chrome\content\helper.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\helper@helper\chrome\content\browser.xul
- %TEMP%\tmp5207.tmp
- %APPDATA%\micron\uninstall.exe
- %APPDATA%\micron\home.js
- %TEMP%\tmpb801.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json
Deletes the following files
- %TEMP%\tmp4c99.tmp
- %TEMP%\tmp5207.tmp
- %TEMP%\tmp52a5.tmp
- %TEMP%\tmp5217.tmp
- %TEMP%\tmp70fe.tmp
- %TEMP%\tmpa2c9.tmp
- %TEMP%\tmpa2ca.tmp
- %TEMP%\tmpb7f0.tmp
- %TEMP%\tmpb801.tmp
Substitutes the following files
- %HOMEPATH%\ntuser.pol
- %PROGRAMDATA%\ntuser.pol
Network activity
Connects to
- 'localhost':49174
- 'localhost':49176
UDP
- DNS ASK te###tstuk.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Creates and executes the following
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\GroupPolicy /t /e /g все:f' (with hidden window)
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\GroupPolicy /t /e /g Everyone:f' (with hidden window)
- '<SYSTEM32>\takeown.exe' /F <SYSTEM32>\GroupPolicy' (with hidden window)
- '<SYSTEM32>\cmd.exe' xcopy "%APPDATA%\Micron\GroupPolicy" <SYSTEM32>\GroupPolicy /E /I /R /Y /H' (with hidden window)
- '<SYSTEM32>\cacls.exe' %WINDIR%\SysWOW64\GroupPolicy /t /e /g Everyone:f' (with hidden window)
- '<SYSTEM32>\cacls.exe' %WINDIR%\SysWOW64\GroupPolicy /t /e /g все:f' (with hidden window)
- '<SYSTEM32>\takeown.exe' /F %WINDIR%\SysWOW64\GroupPolicy' (with hidden window)
- '<SYSTEM32>\cmd.exe' xcopy "%APPDATA%\Micron\GroupPolicy" %WINDIR%\SysWOW64\GroupPolicy /E /I /R /Y /H' (with hidden window)
- '<SYSTEM32>\cmd.exe' echo y | gpupdate /force /wait:0' (with hidden window)
- '<SYSTEM32>\gpupdate.exe' /force /wait:0' (with hidden window)
Executes the following
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\GroupPolicy /t /e /g все:f
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="744.0.763784284\1504341237" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gpu...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' about:blank
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\gpupdate.exe' /force /wait:0
- '<SYSTEM32>\cmd.exe' echo y | gpupdate /force /wait:0
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '<SYSTEM32>\cmd.exe' xcopy "%APPDATA%\Micron\GroupPolicy" %WINDIR%\SysWOW64\GroupPolicy /E /I /R /Y /H
- '<SYSTEM32>\cacls.exe' %WINDIR%\SysWOW64\GroupPolicy /t /e /g все:f
- '<SYSTEM32>\cacls.exe' %WINDIR%\SysWOW64\GroupPolicy /t /e /g Everyone:f
- '<SYSTEM32>\cmd.exe' xcopy "%APPDATA%\Micron\GroupPolicy" <SYSTEM32>\GroupPolicy /E /I /R /Y /H
- '<SYSTEM32>\takeown.exe' /F <SYSTEM32>\GroupPolicy
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\GroupPolicy /t /e /g Everyone:f
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe' about:blank
- '<SYSTEM32>\takeown.exe' /F %WINDIR%\SysWOW64\GroupPolicy
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
