Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\browser.lnk
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following
- '' (downloaded from the Internet)
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im k4.exe
Injects code into
the following user processes:
- dllhosts.exe
Modifies file system
Creates the following files
- C:\users\public\documents\rdsv1.dll
- %WINDIR%\temp\fwtsqmfile01.sqm
- %TEMP%\hzqxjtg
- %TEMP%\aut398.tmp
- %TEMP%\wblhrjw
- %TEMP%\aut1c4.tmp
- C:\users\public\documents\tasloginbase.dll
- C:\users\public\documents\unzip.lnk
- C:\users\public\documents\unzip.dat
- C:\users\public\documents\unzip.exe
- C:\users\public\documents\sch.vbe
- C:\users\public\documents\k4.exe
- C:\users\public\documents\dllhosts.exe
- C:\users\public\documents\2022060125.vbe
- C:\users\public\documents\update.lnk
- C:\users\public\documents\update.log
- %TEMP%\aut471d.tmp
- %TEMP%\ssxwhmq
Deletes the following files
- %TEMP%\aut1c4.tmp
- %TEMP%\wblhrjw
- %TEMP%\aut398.tmp
- %TEMP%\hzqxjtg
- %TEMP%\aut471d.tmp
- %TEMP%\ssxwhmq
Network activity
Connects to
- 'de########.microsoftmiddlename.tk':80
- 'se##.##.#icrosoftmiddlename.tk':8080
TCP
HTTP GET requests
- http://de########.microsoftmiddlename.tk/picturess/RDSv1.dll
- http://de########.microsoftmiddlename.tk/picturess/214.105.log
- http://de########.microsoftmiddlename.tk/picturess/13.txt
- http://de########.microsoftmiddlename.tk/picturess/uvb.jpg
- http://de########.microsoftmiddlename.tk/picturess/systems.exe
- http://de########.microsoftmiddlename.tk/picturess/IMG2022.jpg
- http://de########.microsoftmiddlename.tk/picturess/pig.jpg
- http://de########.microsoftmiddlename.tk/picturess/unzip.exe
- http://de########.microsoftmiddlename.tk/picturess/unzip.jpg
- http://de########.microsoftmiddlename.tk/picturess/unziplnk.jpg
- http://de########.microsoftmiddlename.tk/picturess/TASLoginBase6.dll
Other
- 'se##.##.#icrosoftmiddlename.tk':8080
UDP
- DNS ASK de########.microsoftmiddlename.tk
- DNS ASK se##.##.#icrosoftmiddlename.tk
- 'localhost':62557
- 'localhost':55789
- 'localhost':60121
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'CTXOPConntion_Class' WindowName: ''
Creates and executes the following
- 'C:\users\public\documents\k4.exe'
- 'C:\users\public\documents\k4.exe' /D
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\Documents\sch.vbe"
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\Documents\2022060125.vbe"
- 'C:\users\public\documents\dllhosts.exe'
- 'C:\users\public\documents\unzip.exe' -o -P Startup8888 C:\Users\Public\Documents\unzip.dat -d "%APPDATA%"
- 'C:\users\public\documents\k4.exe' /E
- 'C:\users\public\documents\k4.exe' ' (with hidden window)
- 'C:\users\public\documents\k4.exe' /D' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /t /im k4.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\Documents\2022060125.vbe' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\Documents\sch.vbe"' (with hidden window)
- 'C:\users\public\documents\dllhosts.exe' ' (with hidden window)
- 'C:\users\public\documents\k4.exe' /E' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /t /im k4.exe
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\Documents\2022060125.vbe
