Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%ProgramFiles(x86)%\Windows Photo Viewer\en-US\lsm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Internet Explorer\jsdbgui\iexplore.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\cmd\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\csrss
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\windows photo viewer\en-us\lsm.exe
- %TEMP%\uuwhi9uzos
- %TEMP%\cfadxukurn
- %TEMP%\sr668fzdpz
- %TEMP%\wvsjkt0u6a
- %TEMP%\pe7bupie3u
- %TEMP%\vnjycemezp
- %TEMP%\zivb3dzq15
- %TEMP%\8y1usy2r3p
- %TEMP%\wxz6lcm9rl
- %TEMP%\utxntyldoa
- %TEMP%\o2h9x7ibco
- %TEMP%\jgqiw6fhel
- %TEMP%\xc1v93hoh1
- %TEMP%\antm2xxg4o
- nul
- %TEMP%\p2jzltykoe.bat
- %TEMP%\2wputq6thh
- %WINDIR%\syswow64\cmd\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %WINDIR%\syswow64\cmd\csrss.exe
- %ProgramFiles(x86)%\internet explorer\jsdbgui\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles(x86)%\internet explorer\jsdbgui\iexplore.exe
- %ProgramFiles(x86)%\windows photo viewer\en-us\101b941d020240259ca4912829b53995ad543df6
- %TEMP%\fsgxlpb9d4
- %TEMP%\afzerquzwz
Deletes the following files
- %TEMP%\2wputq6thh
- %TEMP%\uuwhi9uzos
- %TEMP%\cfadxukurn
- %TEMP%\sr668fzdpz
- %TEMP%\wvsjkt0u6a
- %TEMP%\pe7bupie3u
- %TEMP%\vnjycemezp
- %TEMP%\o2h9x7ibco
- %TEMP%\zivb3dzq15
- %TEMP%\wxz6lcm9rl
- %TEMP%\utxntyldoa
- %TEMP%\jgqiw6fhel
- %TEMP%\fsgxlpb9d4
- %TEMP%\xc1v93hoh1
- %TEMP%\antm2xxg4o
- %TEMP%\8y1usy2r3p
- %TEMP%\afzerquzwz
Network activity
Connects to
- '17#.#13.81.2':80
TCP
HTTP GET requests
- http://17#.#13.81.2/Externalimagerequestgamewindows.php?E8#######################################################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\windows photo viewer\en-us\lsm.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\p2JZlTyKOe.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\jsdbgui\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\cmd\csrss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\p2JZlTyKOe.bat"
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
