Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"<SYSTEM32>\hlink\lsass.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\lsm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\audiodg.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\audiodg
Modifies file system
Creates the following files
- <SYSTEM32>\hlink\lsass.exe
- <SYSTEM32>\hlink\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\lsm.exe
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\101b941d020240259ca4912829b53995ad543df6
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\audiodg.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
Network activity
Connects to
- 'bing.com':443
- '19#.#26.139.141':80
TCP
Other
- 'bing.com':443
UDP
- DNS ASK bing.com
Miscellaneous
Creates and executes the following
- '<Full path to file>' ' (with hidden window)
- '<SYSTEM32>\napdsnap\dwm.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'<SYSTEM32>\hlink\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'<SYSTEM32>\KBDSYR1\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\onex\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\napdsnap\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\WUDFHost.exe'" /rl HIGHEST /f
