Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'wrThgeiJsGNQYVqWueuUhnPDPLW' = '%WINDIR%\Resources\Themes\aero\Shell\DgmpdPElraSDPcBMkFkUKvTjMcY\svchost.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\wrthgeijsgnqyvqwueuuhnpdplw.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wrThgeiJsGNQYVqWueuUhnPDPLW.exe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Resources\Themes\aero\Shell\DgmpdPElraSDPcBMkFkUKvTjMcY\svchost.exe' = '00000000'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\㽡㽣㽳㽒㽠㽊㽫㼿㽟㽒㽆㽌㽬㽂㽏㼾㽮㽉㽏㽅㽦㽨㽒㽅㽳\<File name>.exe_url_40zqdo55jinuidgn1quocphg354j4ynf\2.230.455.226\znihellx.newcfg
- %TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\advancedrun.exe
- %TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\test.bat
- %WINDIR%\resources\themes\aero\shell\dgmpdpelrasdpcbmkfkukvtjmcy\svchost.exe
- %TEMP%\4acacfb8-51b9-48e2-a248-12b8ac495f99\0eba19e5-067a-4855-8c83-d7c10e8eb074.exe
- %LOCALAPPDATA%\㽡㽣㽳㽒㽠㽊㽫㼿㽟㽒㽆㽌㽬㽂㽏㼾㽮㽉㽏㽅㽦㽨㽒㽅㽳\wrthgeijsgnqyvqwueuuhnpdp_url_xugyndrh2jvhaugyumlfwwi25kyy4ill\2.230.455.226\nssruxdp.newcfg
- %TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\advancedrun.exe
- %TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\test.bat
- %TEMP%\e4bb699d-6c07-4cce-b8e6-44f23c2c557c\af8427c8-d5b5-4900-b6ab-1b475a0d588c.exe
Deletes the following files
- %TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\advancedrun.exe
- %TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\test.bat
- %TEMP%\4acacfb8-51b9-48e2-a248-12b8ac495f99\0eba19e5-067a-4855-8c83-d7c10e8eb074.exe
- %TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\advancedrun.exe
- %TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\test.bat
- %TEMP%\e4bb699d-6c07-4cce-b8e6-44f23c2c557c\af8427c8-d5b5-4900-b6ab-1b475a0d588c.exe
Moves the following files
- from %LOCALAPPDATA%\㽡㽣㽳㽒㽠㽊㽫㼿㽟㽒㽆㽌㽬㽂㽏㼾㽮㽉㽏㽅㽦㽨㽒㽅㽳\<File name>.exe_url_40zqdo55jinuidgn1quocphg354j4ynf\2.230.455.226\znihellx.newcfg to %LOCALAPPDATA%\㽡㽣㽳㽒㽠㽊㽫㼿㽟㽒㽆㽌㽬㽂㽏㼾㽮㽉㽏㽅㽦㽨㽒㽅㽳\<File name>.exe_url_40zqdo55jinuidgn1quocphg354j4ynf\2.230.455.226\user.config
- from %LOCALAPPDATA%\㽡㽣㽳㽒㽠㽊㽫㼿㽟㽒㽆㽌㽬㽂㽏㼾㽮㽉㽏㽅㽦㽨㽒㽅㽳\wrthgeijsgnqyvqwueuuhnpdp_url_xugyndrh2jvhaugyumlfwwi25kyy4ill\2.230.455.226\nssruxdp.newcfg to %LOCALAPPDATA%\㽡㽣㽳㽒㽠㽊㽫㼿㽟㽒㽆㽌㽬㽂㽏㼾㽮㽉㽏㽅㽦㽨㽒㽅㽳\wrthgeijsgnqyvqwueuuhnpdp_url_xugyndrh2jvhaugyumlfwwi25kyy4ill\2.230.455.226\user.config
Network activity
Connects to
- 'li########abestteamoftheworld.com':80
- 'li########abestteamoftheworld.com':443
TCP
HTTP GET requests
- http://li########abestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-410C7BB1BDB845E74A15ED223D70E498.html
UDP
- DNS ASK li########abestteamoftheworld.com
Miscellaneous
Creates and executes the following
- '%TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\advancedrun.exe' /EXEFilename "%TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\4acacfb8-51b9-48e2-a248-12b8ac495f99\0eba19e5-067a-4855-8c83-d7c10e8eb074.exe' /SpecialRun 4101d8 2564
- '%TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\advancedrun.exe' /SpecialRun 4101d8 2576
- '%TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\advancedrun.exe' /EXEFilename "%TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\advancedrun.exe' /SpecialRun 4101d8 2036
- '%TEMP%\e4bb699d-6c07-4cce-b8e6-44f23c2c557c\af8427c8-d5b5-4900-b6ab-1b475a0d588c.exe' /EXEFilename "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wrThgeiJsGNQYVqWueuUhnPDPLW.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\4acacfb8-51b9-48e2-a248-12b8ac495f99\0eba19e5-067a-4855-8c83-d7c10e8eb074.exe' /EXEFilename "<Full path to file>" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%APPDATA%\microsoft\windows\start menu\programs\startup\wrthgeijsgnqyvqwueuuhnpdplw.exe'
- '%TEMP%\e4bb699d-6c07-4cce-b8e6-44f23c2c557c\af8427c8-d5b5-4900-b6ab-1b475a0d588c.exe' /SpecialRun 4101d8 2140
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\DgmpdPElraSDPcBMkFkUKvTjMcY\svchost.exe" -Force
- '%TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\advancedrun.exe' /EXEFilename "%TEMP%\f82b422c-2349-4fe0-8b15-378d24ab12ea\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\advancedrun.exe' /EXEFilename "%TEMP%\98774b7f-ac1d-4c87-8a21-de2537125b8f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\e4bb699d-6c07-4cce-b8e6-44f23c2c557c\af8427c8-d5b5-4900-b6ab-1b475a0d588c.exe' /EXEFilename "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wrThgeiJsGNQYVqWueuUhnPDPLW.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%TEMP%\4acacfb8-51b9-48e2-a248-12b8ac495f99\0eba19e5-067a-4855-8c83-d7c10e8eb074.exe' /EXEFilename "<Full path to file>" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wrThgeiJsGNQYVqWueuUhnPDPLW.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\DgmpdPElraSDPcBMkFkUKvTjMcY\svchost.exe" -Force' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wrThgeiJsGNQYVqWueuUhnPDPLW.exe" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\DgmpdPElraSDPcBMkFkUKvTjMcY\svchost.exe" -Force
