Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\495e-aeef
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\15675.cmd
- %TEMP%\7zipsfx.000\8522.cmd
- %TEMP%\7zipsfx.000\12224.cmd
- %TEMP%\7zipsfx.000\defvdbwq4kzdfdiys
- %TEMP%\7zipsfx.000\12675.exe
- %TEMP%\7zipsfx.000\9274.exe
- %TEMP%\7zipsfx.000\ajeuv
- %APPDATA%\microsoft\crypto\keys\495e-aeef\cryptcp.exe
- %TEMP%\7zipsfx.000\dec_12675.exe
Deletes the following files
- %TEMP%\7zipsfx.000\ajeuv
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\9274.exe' "12675.exe" dec "gjghj,eqhfcgfreqgbyljc"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\15675.cmd" otu"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\15675.cmd" otu"
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 11 /F /tn 495E-AEEF /tr "%APPDATA%\Microsoft\Crypto\keys\495E-AEEF\cryptcp.exe"
- '%WINDIR%\syswow64\fc.exe' /b "<Full path to file>" "%APPDATA%\Microsoft\Crypto\keys\495E-AEEF\cryptcp.exe"
- '%WINDIR%\syswow64\cmd.exe' /c vol c
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\cmd.exe' /c systeminfo
- '%WINDIR%\syswow64\find.exe' /I "ProxyPass"
- '%WINDIR%\syswow64\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyPass"
- '%WINDIR%\syswow64\find.exe' /I "ProxyUser"
- '%WINDIR%\syswow64\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
- '%WINDIR%\syswow64\find.exe' /I "ProxyServer"
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 00000002 /f
- '%WINDIR%\syswow64\reg.exe' Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
- '%WINDIR%\syswow64\findstr.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "Name='<File name>.exe'" get ExecutablePath /value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "Name='<File name>.exe'" get ExecutablePath /value| findstr
- '%WINDIR%\syswow64\tasklist.exe' /fi "PID eq 2028" /fo csv
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /fi "PID eq 2028 " /fo csv
- '%WINDIR%\syswow64\wbem\wmic.exe' process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\find.exe' /C "cryptcp.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "imagename eq cryptcp.exe"
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /FI "imagename eq cryptcp.exe" | find /C "cryptcp.exe"
- '%WINDIR%\syswow64\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
- '%WINDIR%\syswow64\timeout.exe' /t 131
