Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\l-2-7-57-1280914857-1108034935-1404807179-2220\{qyxviaxi-syfn-zmsg-axop-69uka9afpsqh}
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xg2ock40\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ubtj5ck8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\g43bqhkk\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\2rwr36wa\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xg2ock40\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ubtj5ck8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\g43bqhkk\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\2rwr36wa\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Moves itself
- from <Full path to file> to %APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107\actioncenter.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
UDP
- DNS ASK yi#.su
- DNS ASK microsoft.com
- DNS ASK oc##.thawte.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\amd64...' (with hidden window)
- '%APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107\actioncenter.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c icacls "%APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "%APPDATA%\amd64...
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
- '%WINDIR%\syswow64\icacls.exe' "%APPDATA%\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_10.0.18362.1_en-us_631877d702c2c107" /inheritance:e /deny "user:(R,REA,RA,RD)"
- '<SYSTEM32>\taskeng.exe' {752AE174-406A-4159-9CA6-69EC0EF5C4DC} S-1-5-21-1960123792-2022915161-3775307078-1001:wtxlfiponqk\user:Interactive:[1]
