Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'hEePXYurqLMYWIBOeKDYKk' = '%WINDIR%\Resources\Themes\apfhnxJipLWR\svchost.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\heepxyurqlmywiboekdykk.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\hEePXYurqLMYWIBOeKDYKk.exe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Resources\Themes\apfhnxJipLWR\svchost.exe' = '00000000'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\₀ₔ₲₎₴₩₋₉ₓₙ₥₳₴₹₥₣ₖ₶ₗ₋ₓ₠₮\<File name>.exe_url_0e50hmuocs1ce5rrht1mvb3lzj1ov0wg\6.5.223.976\n2dwtprp.newcfg
- %TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\advancedrun.exe
- %TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\test.bat
- %WINDIR%\resources\themes\apfhnxjiplwr\svchost.exe
- %TEMP%\c4b1fd58-bc5b-403e-8cfc-f34fdddab85a\8bb81023-6172-4fae-aa32-9a849353848a.exe
- %LOCALAPPDATA%\₀ₔ₲₎₴₩₋₉ₓₙ₥₳₴₹₥₣ₖ₶ₗ₋ₓ₠₮\heepxyurqlmywiboekdykk.ex_url_21la3cm3l3ezquszris55mtmydfnnqkh\6.5.223.976\p3frsf5m.newcfg
- %TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\advancedrun.exe
- %TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\test.bat
- %TEMP%\bdf159ce-eb6e-4b43-bcec-a49e3dc841cd\12bdc743-9dc3-4ba1-9d09-5521772023a7.exe
Deletes the following files
- %TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\advancedrun.exe
- %TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\test.bat
- %TEMP%\c4b1fd58-bc5b-403e-8cfc-f34fdddab85a\8bb81023-6172-4fae-aa32-9a849353848a.exe
- %TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\advancedrun.exe
- %TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\test.bat
- %TEMP%\bdf159ce-eb6e-4b43-bcec-a49e3dc841cd\12bdc743-9dc3-4ba1-9d09-5521772023a7.exe
Moves the following files
- from %LOCALAPPDATA%\₀ₔ₲₎₴₩₋₉ₓₙ₥₳₴₹₥₣ₖ₶ₗ₋ₓ₠₮\<File name>.exe_url_0e50hmuocs1ce5rrht1mvb3lzj1ov0wg\6.5.223.976\n2dwtprp.newcfg to %LOCALAPPDATA%\₀ₔ₲₎₴₩₋₉ₓₙ₥₳₴₹₥₣ₖ₶ₗ₋ₓ₠₮\<File name>.exe_url_0e50hmuocs1ce5rrht1mvb3lzj1ov0wg\6.5.223.976\user.config
- from %LOCALAPPDATA%\₀ₔ₲₎₴₩₋₉ₓₙ₥₳₴₹₥₣ₖ₶ₗ₋ₓ₠₮\heepxyurqlmywiboekdykk.ex_url_21la3cm3l3ezquszris55mtmydfnnqkh\6.5.223.976\p3frsf5m.newcfg to %LOCALAPPDATA%\₀ₔ₲₎₴₩₋₉ₓₙ₥₳₴₹₥₣ₖ₶ₗ₋ₓ₠₮\heepxyurqlmywiboekdykk.ex_url_21la3cm3l3ezquszris55mtmydfnnqkh\6.5.223.976\user.config
Network activity
Connects to
- 'li########abestteamoftheworld.com':80
- 'li########abestteamoftheworld.com':443
TCP
HTTP GET requests
- http://li########abestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-62EC4A0640ACBC42B44A33B3B17A1707.html
- http://li########abestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-A5B5F277F16611517CC1673646D3E8A6.html
- http://li########abestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7DA26C9743D23B8EA792A31223330543.html
UDP
- DNS ASK li########abestteamoftheworld.com
Miscellaneous
Creates and executes the following
- '%TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\advancedrun.exe' /EXEFilename "%TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\c4b1fd58-bc5b-403e-8cfc-f34fdddab85a\8bb81023-6172-4fae-aa32-9a849353848a.exe' /SpecialRun 4101d8 2768
- '%TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\advancedrun.exe' /SpecialRun 4101d8 2288
- '%TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\advancedrun.exe' /EXEFilename "%TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\advancedrun.exe' /SpecialRun 4101d8 1144
- '%TEMP%\bdf159ce-eb6e-4b43-bcec-a49e3dc841cd\12bdc743-9dc3-4ba1-9d09-5521772023a7.exe' /EXEFilename "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\hEePXYurqLMYWIBOeKDYKk.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\c4b1fd58-bc5b-403e-8cfc-f34fdddab85a\8bb81023-6172-4fae-aa32-9a849353848a.exe' /EXEFilename "<Full path to file>" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%APPDATA%\microsoft\windows\start menu\programs\startup\heepxyurqlmywiboekdykk.exe'
- '%TEMP%\bdf159ce-eb6e-4b43-bcec-a49e3dc841cd\12bdc743-9dc3-4ba1-9d09-5521772023a7.exe' /SpecialRun 4101d8 2124
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\apfhnxJipLWR\svchost.exe" -Force
- '%TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\advancedrun.exe' /EXEFilename "%TEMP%\d9730832-f927-4dd1-b8bc-c73d11de7def\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\advancedrun.exe' /EXEFilename "%TEMP%\97f27c45-e868-4296-895d-382f80ecc04a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\bdf159ce-eb6e-4b43-bcec-a49e3dc841cd\12bdc743-9dc3-4ba1-9d09-5521772023a7.exe' /EXEFilename "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\hEePXYurqLMYWIBOeKDYKk.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\c4b1fd58-bc5b-403e-8cfc-f34fdddab85a\8bb81023-6172-4fae-aa32-9a849353848a.exe' /EXEFilename "<Full path to file>" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\hEePXYurqLMYWIBOeKDYKk.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\apfhnxJipLWR\svchost.exe" -Force' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\hEePXYurqLMYWIBOeKDYKk.exe" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\apfhnxJipLWR\svchost.exe" -Force
