Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'trkcore' = '%ALLUSERSPROFILE%\Microsoft\Roaming\svchost.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Injects code into
the following system processes:
- <SYSTEM32>\csrss.exe
the following user processes:
- firefox.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\dllhost.exe
- %WINDIR%\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
- <SYSTEM32>\runtimebroker.exe
- %WINDIR%\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe
the following user processes:
- iexplore.exe
Modifies file system
Substitutes the following executable files
- <Full path to file>
Substitutes the following files
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
Moves itself
- from <Full path to file> to <Current directory>\old_<File name>.exe
Network activity
TCP
HTTP GET requests
- http://w.google.com/
- http://pa###bin.com/raw/AqndxJKK
UDP
- DNS ASK share.microsoft.com
- DNS ASK 3E###y4o5T.com
- DNS ASK 8J###guboy.com
- DNS ASK pa###bin.com
- DNS ASK w.google.com
- DNS ASK Zp###Rz1Sr.com
- DNS ASK LM###Df7Pi.com
- DNS ASK En###3YKOh.com
- DNS ASK QB###fuP9u.com
- DNS ASK ar#.msn.com
- DNS ASK em###rzSWF.com
- DNS ASK dl.delivery.mp.microsoft.com
- DNS ASK maps.windows.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK go.microsoft.com
- DNS ASK 4x###UBklM.com
- DNS ASK 22###69PZL.com
- DNS ASK im##########-rt-microsoft-com.akamaized.net
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Executes the following
- '<SYSTEM32>\devicecensus.exe' UserCxt
- '<SYSTEM32>\svchost.exe' -k netsvcs -p
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\svchost.exe' -k ClipboardSvcGroup -p
- '%WINDIR%\explorer.exe' /LOADSAVEDWINDOWS
