Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\aqijjwybwaka
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Internet Account Manager]
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows Mail]
- [<HKCU>\Software\Microsoft\Windows Mail]
- [<HKCU>\Software\FTPware\CoreFTP\Sites]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %APPDATA%\aqijjwybwaka.exe
- %TEMP%\tmp8065.tmp
- %APPDATA%\microsoft\windows\templates\files\hanni_umami_chapter.doc
- %APPDATA%\microsoft\windows\templates\files.zip
Sets the 'hidden' attribute to the following files
- %APPDATA%\aqijjwybwaka.exe
Deletes the following files
- %TEMP%\tmp8065.tmp
- %APPDATA%\microsoft\windows\templates\files\hanni_umami_chapter.doc
- %APPDATA%\microsoft\windows\templates\files.zip
Network activity
Connects to
- 'ma##.#ursat.com.tr':587
- 'ic###azip.com':80
TCP
HTTP GET requests
- http://ic###azip.com/
Other
- 'ma##.#ursat.com.tr':587
UDP
- DNS ASK ma##.#ursat.com.tr
- DNS ASK ic###azip.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\AqIjjWybwaKA.exe"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\AqIjjWybwaKA.exe"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\AqIjjWybwaKA" /XML "%TEMP%\tmp8065.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\AqIjjWybwaKA" /XML "%TEMP%\tmp8065.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
