Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%TEMP%\MSDCSC\msdcsc.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%TEMP%\MSDCSC\msdcsc.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdatexlaruy0x8429524
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\autbf29.tmp
- %TEMP%\wvpgxf.exe
- %TEMP%\autbf59.tmp
- %TEMP%\yakcss.txt
- %TEMP%\autbf98.tmp
- %TEMP%\xlaruy
- %ALLUSERSPROFILE%\xlaruy\wvpgxf.exe
- %ALLUSERSPROFILE%\xlaruy\yakcss.txt
- %ALLUSERSPROFILE%\xlaruy\apunpl.vbs
- %ALLUSERSPROFILE%\xlaruy\xlaruy
- %TEMP%\msdcsc\msdcsc.exe
Deletes the following files
- %TEMP%\autbf29.tmp
- %TEMP%\autbf59.tmp
- %TEMP%\autbf98.tmp
- %TEMP%\xlaruy
- %TEMP%\yakcss.txt
- %TEMP%\wvpgxf.exe
Moves the following files
- from %TEMP%\wvpgxf.exe to %TEMP%\wvpgxf.exe
Substitutes the following files
- %TEMP%\xlaruy
- %TEMP%\yakcss.txt
- %TEMP%\wvpgxf.exe
Network activity
UDP
- DNS ASK co####ls.ddns.net
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'Error'
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\wvpgxf.exe' xLARuY
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\xlaruy\ApuNpl.vbs"
- '%ALLUSERSPROFILE%\xlaruy\wvpgxf.exe' xLARuY
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\WvpGXF.exe xLARuY' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn WindowsUpdatexlaruy0x8429524 /tr "%ALLUSERSPROFILE%\xlaruy\ApuNpl.vbs"' (with hidden window)
- '%WINDIR%\syswow64\notepad.exe' ' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\xlaruy\ApuNpl.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C CD /D "%ALLUSERSPROFILE%\xlaruy\" && WvpGXF.exe xLARuY' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\WvpGXF.exe xLARuY
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn WindowsUpdatexlaruy0x8429524 /tr "%ALLUSERSPROFILE%\xlaruy\ApuNpl.vbs"
- '%WINDIR%\syswow64\notepad.exe'
- '<SYSTEM32>\taskeng.exe' {026A511C-6BBD-4CF5-BD0B-59F94D124ABF} S-1-5-21-1960123792-2022915161-3775307078-1001:hfrhkmaiuve\user:Interactive:[1]
- '<SYSTEM32>\cmd.exe' /C CD /D "%ALLUSERSPROFILE%\xlaruy\" && WvpGXF.exe xLARuY
