Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\kvfkq4
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\system
Modifies file system
Creates the following files
- %TEMP%\o31h1tda.exe
- <SYSTEM32>\nsisvc\conhost.exe
- <SYSTEM32>\nsisvc\088424020bedd6b28ac7fd22ee35dcd7322895ce
- <SYSTEM32>\mfc140u\wudfhost.exe
- <SYSTEM32>\mfc140u\480b7989c529f6ff17bde430d81d4770fb5337f5
- <SYSTEM32>\wmvsencd\smss.exe
- <SYSTEM32>\wmvsencd\69ddcba757bf72f7d36c464c71f42baab150b2b9
- C:\users\default\saved games\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %ProgramFiles%\fsaua\system.exe
- <SYSTEM32>\perftrack\csrss.exe
- <SYSTEM32>\perftrack\886983d96e3d3e31032c679b2d4ea91b6c05afef
- <Current directory>\dwm.exe
- <Current directory>\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- %ProgramFiles%\vsserv\csrss.exe
- %ProgramFiles%\vsserv\886983d96e3d3e31032c679b2d4ea91b6c05afef
- <SYSTEM32>\rdrleakdiag\b75386f1303e64d8139363b71e44ac16341adf4e
- C:\users\default\saved games\csrss.exe
- <SYSTEM32>\rdrleakdiag\taskhost.exe
- C:\far2\documentation\eng\services.exe
- %TEMP%\kvfkq4.exe
- C:\savesbrokerhostcrtcommon\9hbiwjzceaqzcsr.bat
- C:\savesbrokerhostcrtcommon\savesbrokerhostcrtcommonsavessession.exe
- C:\savesbrokerhostcrtcommon\qgxidkxusj.vbe
- <SYSTEM32>\pla\lsass.exe
- <SYSTEM32>\pla\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- C:\far2\documentation\eng\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
- %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log\kvfkq4.exe
- <SYSTEM32>\iashlpr\wudfhost.exe
- <SYSTEM32>\iashlpr\480b7989c529f6ff17bde430d81d4770fb5337f5
- C:\perflogs\admin\wininit.exe
- C:\perflogs\admin\560854153607923c4c5f107085a7db67be01f252
- %WINDIR%\performance\winsat\datastore\lsm.exe
- %WINDIR%\performance\winsat\datastore\101b941d020240259ca4912829b53995ad543df6
- %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log\6bbd1ae58f8710fc1c975979003e07f21802dc27
- %ProgramFiles%\fsaua\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a
Network activity
Connects to
- '62.##9.21.205':80
TCP
HTTP GET requests
- http://62.##9.21.205/download/rust/KvfKQ4.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\o31h1tda.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\savesBrokerHostcrtCommon\qGXIDkxUsj.vbe"
- '%TEMP%\kvfkq4.exe'
- 'C:\savesbrokerhostcrtcommon\savesbrokerhostcrtcommonsavessession.exe'
- 'C:\users\default\saved games\csrss.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\savesBrokerHostcrtCommon\9HbiWjZCeaqZCsR.bat" "' (with hidden window)
- 'C:\savesbrokerhostcrtcommon\savesbrokerhostcrtcommonsavessession.exe' ' (with hidden window)
- 'C:\users\default\saved games\csrss.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\savesBrokerHostcrtCommon\9HbiWjZCeaqZCsR.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'<SYSTEM32>\pla\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<SYSTEM32>\iashlpr\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\Admin\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%WINDIR%\Performance\WinSAT\DataStore\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "KvfKQ4" /sc ONLOGON /tr "'%TEMP%\dd_NDP452-KB2901907-x86-x64-AllOS-ENU_decompression_log\KvfKQ4.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<SYSTEM32>\rdrleakdiag\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'<SYSTEM32>\nsisvc\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<SYSTEM32>\mfc140u\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<SYSTEM32>\WMVSENCD\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\perftrack\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles%\vsserv\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles%\fsaua\System.exe'" /rl HIGHEST /f
