Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\9b996ba5-a3cf-46b6-b4e8-90723179b185\<File name>.exe" --AutoStart'
Creates or modifies the following files
- <SYSTEM32>\tasks\time trigger task
Creates the following files on removable media
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\wrar520.exe
- <Drive name for removable media>:\notepad.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\tcm851ax32.exe
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\asaprojectcompetition.pptx
Modifies file system
Creates the following files
- %LOCALAPPDATA%\9b996ba5-a3cf-46b6-b4e8-90723179b185\<File name>.exe
- %LOCALAPPDATA%\bowsakkdestx.txt
- C:\systemid\personalid.txt
- %LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\updatewin1.exe
- %LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\updatewin2.exe
- %LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\5.exe
Deletes the following files
- <SYSTEM32>\tasks\time trigger task
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ap#.2ip.ua':443
TCP
HTTP GET requests
- http://as##.top/nddddhsspen6/get.php?pi#############################################
Other
- 'ap#.2ip.ua':443
UDP
- DNS ASK ap#.2ip.ua
- DNS ASK as##.top
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\updatewin1.exe'
- '%LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\updatewin2.exe'
- '%LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\5.exe'
- '%LOCALAPPDATA%\4eb36f9c-8ef1-4fae-9201-5359beb1dec5\updatewin1.exe' --Admin
- '%LOCALAPPDATA%\9b996ba5-a3cf-46b6-b4e8-90723179b185\<File name>.exe' --Task
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\9b996ba5-a3cf-46b6-b4e8-90723179b185" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned' (with hidden window)
- '%LOCALAPPDATA%\9b996ba5-a3cf-46b6-b4e8-90723179b185\<File name>.exe' --Task' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\9b996ba5-a3cf-46b6-b4e8-90723179b185" /deny *S-1-1-0:(OI)(CI)(DE,DC)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
- '<SYSTEM32>\taskeng.exe' {9268E0E8-0FFD-486D-AE27-D336C2E05656} S-1-5-21-1960123792-2022915161-3775307078-1001:mfqqniolmsyo\user:Interactive:[1]
