Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\Encyclopedia\tap\dwm.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"C:\Far2\Encyclopedia\tap\dwm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"C:\Far2\Encyclopedia\tap\dwm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\Encyclopedia\tap\dwm.exe", "C:\PerfLogs\Admin\csrss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\PerfLogs\Admin\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\PerfLogs\Admin\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\Encyclopedia\tap\dwm.exe", "C:\PerfLogs\Admin\csrss.exe", "C:\Documents and Settings...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\Documents and Settings\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\Documents and Settings\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\csrss
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- C:\far2\encyclopedia\tap\dwm.exe
- C:\far2\encyclopedia\tap\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- C:\perflogs\admin\csrss.exe
- C:\perflogs\admin\886983d96e3d3e31032c679b2d4ea91b6c05afef
- nul
- C:\documents and settings\csrss.exe
- C:\documents and settings\886983d96e3d3e31032c679b2d4ea91b6c05afef
Network activity
Connects to
- 'cf####7.tmweb.ru':80
- 'ip##fo.io':443
TCP
HTTP GET requests
- http://cf####7.tmweb.ru/multiDefaultFlower.php?At################################################################################################################################################...
UDP
- DNS ASK cf####7.tmweb.ru
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- 'C:\documents and settings\csrss.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\dwm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\Admin\csrss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
