Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\system
Modifies file system
Creates the following files
- C:\perflogs\admin\wmiprvse.exe
- C:\perflogs\admin\24dbde2999530ef5fd907494bc374d663924116c
- %ALLUSERSPROFILE%\microsoft\vault\iexplore.exe
- %ALLUSERSPROFILE%\microsoft\vault\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %WINDIR%\directx\explorer.exe
- %WINDIR%\directx\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- C:\totalcmd\language\idle.exe
- C:\totalcmd\language\6ccacd8608530fba3a93e87ae2225c7032aa18c1
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\mdm.exe
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\559fba5f8e44108851927af432f0edac6117c574
- <Current directory>\system.exe
- <Current directory>\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a
- %ProgramFiles(x86)%\internet explorer\jsdebuggeride\iexplore.exe
- %ProgramFiles(x86)%\internet explorer\jsdebuggeride\9db6e019d4f04ef534d0f91b3462d805c40e9d20
Network activity
Connects to
- '18#.#3.188.131':80
TCP
HTTP GET requests
- http://18#.#3.188.131/geoserver.php?NX###########################################################################################################################################################...
UDP
- DNS ASK ip##fo.io
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\internet explorer\jsdebuggeride\iexplore.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\PerfLogs\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft\Vault\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\DirectX\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\coloader\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'<Current directory>\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\jsdebuggeride\iexplore.exe'" /rl HIGHEST /f
