Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Security notification icon' = '"%APPDATA%\Microsoft\Windows Security notification icon.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security notification icon
Modifies file system
Creates the following files
- %TEMP%\8c09.tmp\run.bat
- %TEMP%\8c09.tmp\driver.exe
- %TEMP%\907c.tmp\run.bat
- %TEMP%\907c.tmp\test-ovpn.exe
- %TEMP%\907c.tmp\anarchy.exe
- %TEMP%\907c.tmp\js.exe
- %APPDATA%\microsoft\windows security notification icon.exe
- %TEMP%\af80.tmp\k.bat
- %TEMP%\k0dr2b0whm3p.bat
- nul
- %TEMP%\pofawqyvv2fp.bat
- %TEMP%\zszdedji9fst.bat
- %TEMP%\rp7avbenlmzx.bat
- %TEMP%\lvxsq9whdlfv.bat
- %TEMP%\syemkc7klkl5.bat
- %TEMP%\n45eg9pf4iq3.bat
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows security notification icon.exe
Deletes the following files
- %TEMP%\8c09.tmp\run.bat
- %TEMP%\af80.tmp\k.bat
- %TEMP%\907c.tmp\test-ovpn.exe
- %TEMP%\907c.tmp\anarchy.exe
- %TEMP%\907c.tmp\js.exe
- %TEMP%\907c.tmp\run.bat
Network activity
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
- DNS ASK Pr######n-42895.portmap.io
Miscellaneous
Creates and executes the following
- '%TEMP%\8c09.tmp\driver.exe'
- '%TEMP%\907c.tmp\test-ovpn.exe'
- '%APPDATA%\microsoft\windows security notification icon.exe'
- '%TEMP%\907c.tmp\anarchy.exe'
- '%TEMP%\907c.tmp\js.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8C09.tmp\run.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\907C.tmp\run.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\AF80.tmp\k.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\K0DR2b0whm3p.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\pofawqyVV2FP.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\zSZDedJI9FST.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rP7AvBeNLMZx.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\lvXSq9wHdLFv.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\sYeMkC7klkl5.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\n45eg9Pf4iQ3.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\dfsNXg7J3y8I.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8C09.tmp\run.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\907C.tmp\run.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows Security notification icon" /sc ONLOGON /tr "%TEMP%\907C.tmp\Test-ovpn.exe" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows Security notification icon" /sc ONLOGON /tr "%APPDATA%\Microsoft\Windows Security notification icon.exe" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\AF80.tmp\k.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\K0DR2b0whm3p.bat" "
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\pofawqyVV2FP.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\zSZDedJI9FST.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rP7AvBeNLMZx.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\lvXSq9wHdLFv.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\sYeMkC7klkl5.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\n45eg9Pf4iQ3.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\dfsNXg7J3y8I.bat" "
