Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\playkey\shell\open\command] '' = '"%ProgramFiles(x86)%\Playkey\Playkey.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PlaykeyOffers' = '%ProgramFiles(x86)%\Playkey\PlaykeyOffers.exe'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im "PlaykeyOffers.exe"
Modifies file system
Creates the following files
- %TEMP%\is-jtg4g.tmp\<File name>.tmp
- %ProgramFiles(x86)%\playkey\is-jjfvu.tmp
- %ProgramFiles(x86)%\playkey\is-u0vm0.tmp
- %ProgramFiles(x86)%\playkey\is-6s1kl.tmp
- %ProgramFiles(x86)%\playkey\is-e8ppl.tmp
- %ProgramFiles(x86)%\playkey\is-8im8g.tmp
- %ProgramFiles(x86)%\playkey\is-9h5fg.tmp
- %ProgramFiles(x86)%\playkey\is-rukt2.tmp
- %ProgramFiles(x86)%\playkey\is-psc1u.tmp
- %ProgramFiles(x86)%\playkey\is-dsu4s.tmp
- %ProgramFiles(x86)%\playkey\is-kmg9p.tmp
- %ProgramFiles(x86)%\playkey\is-7e907.tmp
- %ProgramFiles(x86)%\playkey\is-f5muo.tmp
- %ProgramFiles(x86)%\playkey\is-331ka.tmp
- %ProgramFiles(x86)%\playkey\is-antb2.tmp
- %ProgramFiles(x86)%\playkey\is-vsvrv.tmp
- %ProgramFiles(x86)%\playkey\is-qu0no.tmp
- %ProgramFiles(x86)%\playkey\is-lgnr0.tmp
- C:\users\public\desktop\playkey.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\playkey\go to playkey.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\playkey\uninstall playkey.lnk
- %ProgramFiles(x86)%\playkey\sounds\is-j0tf2.tmp
- %ProgramFiles(x86)%\playkey\icons\is-lfv6k.tmp
- %ProgramFiles(x86)%\playkey\icons\is-dq9s0.tmp
- %ProgramFiles(x86)%\playkey\icons\is-iucf4.tmp
- %ProgramFiles(x86)%\playkey\icons\is-kf2gp.tmp
- %ProgramFiles(x86)%\playkey\icons\is-lh8bi.tmp
- %ProgramFiles(x86)%\playkey\icons\is-ki4bv.tmp
- %ProgramFiles(x86)%\playkey\is-7ccet.tmp
- %ProgramFiles(x86)%\playkey\platforms\is-mefhb.tmp
- %ProgramFiles(x86)%\playkey\is-1cb09.tmp
- %ProgramFiles(x86)%\playkey\is-17drt.tmp
- %ProgramFiles(x86)%\playkey\is-g4g53.tmp
- %ProgramFiles(x86)%\playkey\is-ufe2m.tmp
- %ProgramFiles(x86)%\playkey\is-72q4g.tmp
- %ProgramFiles(x86)%\playkey\is-1m58l.tmp
- %ProgramFiles(x86)%\playkey\is-uq3a3.tmp
- %ProgramFiles(x86)%\playkey\is-vfhtk.tmp
- %ProgramFiles(x86)%\playkey\is-m6mcn.tmp
- %ProgramFiles(x86)%\playkey\is-2ra9m.tmp
- %ProgramFiles(x86)%\playkey\is-65kie.tmp
- %ProgramFiles(x86)%\playkey\is-8lfvl.tmp
- %ProgramFiles(x86)%\playkey\is-drddh.tmp
- %ProgramFiles(x86)%\playkey\is-8i4ii.tmp
- %ProgramFiles(x86)%\playkey\is-2hk0q.tmp
- %ProgramFiles(x86)%\playkey\is-6iq7v.tmp
- %ProgramFiles(x86)%\playkey\is-vajfl.tmp
- %ProgramFiles(x86)%\playkey\is-v75jl.tmp
- %ProgramFiles(x86)%\playkey\is-4adgr.tmp
- %ProgramFiles(x86)%\playkey\is-86ma4.tmp
- %ProgramFiles(x86)%\playkey\is-tcdlk.tmp
- %ProgramFiles(x86)%\playkey\is-b8l26.tmp
- %TEMP%\is-q3k6o.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\playkey\unins000.msg
- %ProgramFiles(x86)%\playkey\is-iavvv.tmp
- %ProgramFiles(x86)%\playkey\is-n0p5f.tmp
- %ProgramFiles(x86)%\playkey\is-2k9tg.tmp
- %ProgramFiles(x86)%\playkey\is-c1os5.tmp
- %ProgramFiles(x86)%\playkey\is-mj1oj.tmp
- %ProgramFiles(x86)%\playkey\is-0276e.tmp
- %ProgramFiles(x86)%\playkey\is-188de.tmp
- %ProgramFiles(x86)%\playkey\is-fddfm.tmp
- %ProgramFiles(x86)%\playkey\is-mc2b6.tmp
- %ProgramFiles(x86)%\playkey\is-vae0b.tmp
- %ProgramFiles(x86)%\playkey\is-b6ipk.tmp
- %ProgramFiles(x86)%\playkey\is-qarjh.tmp
- %ProgramFiles(x86)%\playkey\is-so3np.tmp
- %ProgramFiles(x86)%\playkey\is-l3s2l.tmp
- %ProgramFiles(x86)%\playkey\is-87qtt.tmp
- %ProgramFiles(x86)%\playkey\is-kv5vd.tmp
- %ProgramFiles(x86)%\playkey\is-lmpfh.tmp
- %ProgramFiles(x86)%\playkey\is-l36tk.tmp
- %ProgramFiles(x86)%\playkey\is-m56dg.tmp
- %ProgramFiles(x86)%\playkey\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\playkey\is-b8l26.tmp to %ProgramFiles(x86)%\playkey\unins000.exe
- from %ProgramFiles(x86)%\playkey\is-1m58l.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-conio-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-ufe2m.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-convert-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-antb2.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-environment-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-331ka.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-filesystem-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-f5muo.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-heap-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-7e907.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-locale-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-kmg9p.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-math-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-dsu4s.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-multibyte-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-72q4g.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-private-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-vsvrv.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-process-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-9h5fg.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-runtime-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-8im8g.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-stdio-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-e8ppl.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-string-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-6s1kl.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-time-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-jjfvu.tmp to %ProgramFiles(x86)%\playkey\msvcp140.dll
- from %ProgramFiles(x86)%\playkey\icons\is-lfv6k.tmp to %ProgramFiles(x86)%\playkey\icons\wot.ico
- from %ProgramFiles(x86)%\playkey\is-psc1u.tmp to %ProgramFiles(x86)%\playkey\ucrtbase.dll
- from %ProgramFiles(x86)%\playkey\is-rukt2.tmp to %ProgramFiles(x86)%\playkey\vcruntime140.dll
- from %ProgramFiles(x86)%\playkey\is-lgnr0.tmp to %ProgramFiles(x86)%\playkey\qt5core.dll
- from %ProgramFiles(x86)%\playkey\is-iavvv.tmp to %ProgramFiles(x86)%\playkey\qt5gui.dll
- from %ProgramFiles(x86)%\playkey\is-g4g53.tmp to %ProgramFiles(x86)%\playkey\qt5widgets.dll
- from %ProgramFiles(x86)%\playkey\is-17drt.tmp to %ProgramFiles(x86)%\playkey\qt5network.dll
- from %ProgramFiles(x86)%\playkey\is-1cb09.tmp to %ProgramFiles(x86)%\playkey\qt5xml.dll
- from %ProgramFiles(x86)%\playkey\platforms\is-mefhb.tmp to %ProgramFiles(x86)%\playkey\platforms\qwindows.dll
- from %ProgramFiles(x86)%\playkey\is-7ccet.tmp to %ProgramFiles(x86)%\playkey\playkeyoffers.exe
- from %ProgramFiles(x86)%\playkey\icons\is-ki4bv.tmp to %ProgramFiles(x86)%\playkey\icons\dota2.ico
- from %ProgramFiles(x86)%\playkey\icons\is-lh8bi.tmp to %ProgramFiles(x86)%\playkey\icons\fortnite.ico
- from %ProgramFiles(x86)%\playkey\icons\is-kf2gp.tmp to %ProgramFiles(x86)%\playkey\icons\gta5.ico
- from %ProgramFiles(x86)%\playkey\icons\is-iucf4.tmp to %ProgramFiles(x86)%\playkey\icons\pubg.ico
- from %ProgramFiles(x86)%\playkey\icons\is-dq9s0.tmp to %ProgramFiles(x86)%\playkey\icons\witcher3.ico
- from %ProgramFiles(x86)%\playkey\is-uq3a3.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-util-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-u0vm0.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-crt-utility-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-vfhtk.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-timezone-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-n0p5f.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-file-l1-2-0.dll
- from %ProgramFiles(x86)%\playkey\is-tcdlk.tmp to %ProgramFiles(x86)%\playkey\playkey.exe
- from %ProgramFiles(x86)%\playkey\is-86ma4.tmp to %ProgramFiles(x86)%\playkey\playkeyupdater.exe
- from %ProgramFiles(x86)%\playkey\is-4adgr.tmp to %ProgramFiles(x86)%\playkey\crashpad_handler.exe
- from %ProgramFiles(x86)%\playkey\is-v75jl.tmp to %ProgramFiles(x86)%\playkey\libeay32.dll
- from %ProgramFiles(x86)%\playkey\is-6iq7v.tmp to %ProgramFiles(x86)%\playkey\ssleay32.dll
- from %ProgramFiles(x86)%\playkey\is-m6mcn.tmp to %ProgramFiles(x86)%\playkey\openal32.dll
- from %ProgramFiles(x86)%\playkey\is-2hk0q.tmp to %ProgramFiles(x86)%\playkey\wrap_oal.dll
- from %ProgramFiles(x86)%\playkey\is-8i4ii.tmp to %ProgramFiles(x86)%\playkey\xinput1_3.dll
- from %ProgramFiles(x86)%\playkey\is-drddh.tmp to %ProgramFiles(x86)%\playkey\amfrt32.dll
- from %ProgramFiles(x86)%\playkey\is-8lfvl.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-console-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-65kie.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-datetime-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-2ra9m.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-debug-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-c1os5.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-errorhandling-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-vajfl.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-file-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-qu0no.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-file-l2-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-0276e.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-synch-l1-2-0.dll
- from %ProgramFiles(x86)%\playkey\is-m56dg.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-handle-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-2k9tg.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-heap-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-l36tk.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-interlocked-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-lmpfh.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-libraryloader-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-kv5vd.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-localization-l1-2-0.dll
- from %ProgramFiles(x86)%\playkey\is-87qtt.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-memory-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-l3s2l.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-namedpipe-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-so3np.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-processenvironment-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-qarjh.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-processthreads-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-b6ipk.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-processthreads-l1-1-1.dll
- from %ProgramFiles(x86)%\playkey\is-vae0b.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-profile-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-mc2b6.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-rtlsupport-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-fddfm.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-string-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-188de.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-synch-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\is-mj1oj.tmp to %ProgramFiles(x86)%\playkey\api-ms-win-core-sysinfo-l1-1-0.dll
- from %ProgramFiles(x86)%\playkey\sounds\is-j0tf2.tmp to %ProgramFiles(x86)%\playkey\sounds\start.wav
Network activity
TCP
- 'ss#.####le-analytics.com':443
UDP
- DNS ASK ss#.####le-analytics.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-jtg4g.tmp\<File name>.tmp' /SL5="$B01E8,17154200,216064,<Full path to file>"
- '<SYSTEM32>\taskkill.exe' /f /im "PlaykeyOffers.exe"' (with hidden window)
