Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\8aa047478af3bafbda66f9dc66d2ce3a
- <SYSTEM32>\tasks\c514922eeea2bdf372923f11bd310f42
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\--] 'ImagePath' = '<Full path to file> /wl 1'
- [<HKLM>\System\CurrentControlSet\Services\5358012b64bd63da158060d513b962ee] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\5358012b64bd63da158060d513b962ee] 'ImagePath' = '<DRIVERS>\5358012b64bd63da158060d513b962ee.sys'
- [<HKLM>\System\CurrentControlSet\Services\8aa047478af3bafbda66f9dc66d2ce3a] 'ImagePath' = '"%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe"'
- [<HKLM>\System\CurrentControlSet\Services\8aa047478af3bafbda66f9dc66d2ce3a] 'Start' = '00000002'
Creates the following services
- '--' <Full path to file> /wl 1
- '5358012b64bd63da158060d513b962ee' <DRIVERS>\5358012b64bd63da158060d513b962ee.sys
- '8aa047478af3bafbda66f9dc66d2ce3a' "%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe"
- '8aa047478af3bafbda66f9dc66d2ce3a' %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\uninstaller.dat' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\6154e993c2d115565c45015a58e5cc8f.exe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\5358012b64bd63da158060d513b962ee.sys' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\c514922eeea2bdf372923f11bd310f42.ps1' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\c514922eeea2bdf372923f11bd310f42.xml' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\nsg581f.tmp
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\service.dat
- %WINDIR%\temp\udd9d57.tmp
- %WINDIR%\temp\wjmb7d9.tmp
- %WINDIR%\syswow64\ssl\cert.db
- %WINDIR%\syswow64\ssl\81acdcfba1b89dbd 2.cer
- ctrlsm5358012b64bd63da158060d513b962ee
- %WINDIR%\c514922eeea2bdf372923f11bd310f42.ps1
- %WINDIR%\c514922eeea2bdf372923f11bd310f42.xml
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\6154e993c2d115565c45015a58e5cc8f.exe
- %WINDIR%\6154e993c2d115565c45015a58e5cc8f.exe
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\wbe_uninstall.dat
- %WINDIR%\uninstaller.dat
- %ProgramFiles(x86)%\pidgin\ca-certs\81acdcfba1b89dbd 2.pem
- %TEMP%\dc3f.tmp
- %TEMP%\dc4f.tmp
- %TEMP%\dc4f.tmp-shm
- %TEMP%\de34.tmp
- %TEMP%\de44.tmp
- %TEMP%\de44.tmp-shm
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\f67ac4d708c60d5babc601484e69db01.exe
- %TEMP%\nsqdffa.tmp
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\service_64.dat
- <DRIVERS>\5358012b64bd63da158060d513b962ee.sys
- %TEMP%\nsv582f.tmp\system.dll
- %TEMP%\nsv582f.tmp\md5dll.dll
- %TEMP%\nsv582f.tmp\brh.dat
- %TEMP%\nsv582f.tmp\nsexec.dll
- %WINDIR%\temp\nsg6587.tmp
- %WINDIR%\temp\nsg6588.tmp\system.dll
- %WINDIR%\temp\nsg6588.tmp\md5dll.dll
- %WINDIR%\temp\nsg6588.tmp\brh.dat
- %WINDIR%\temp\nsg6588.tmp\brh.dll
- %TEMP%\nsv582f.tmp\brh.dll
- %TEMP%\nsv582f.tmp\ipconfig.dll
- %TEMP%\nsv582f.tmp\inetc.dll
- %TEMP%\nsv582f.tmp\moreinfo.dll
- %TEMP%\nsv582f.tmp\nsislist.dll
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\bd00eb2dce37a379363052e6afe79948.ico
- %TEMP%\nsv582f.tmp\simplesc.dll
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\cce4cbb49f5a105902e44dd059774f15
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\c93d8f000228ae846efb4b529c6e208e
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\beb4bbd584c3de8eceec97df377fcd48
- %ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe
- %TEMP%\nsv582f.tmp\get_local_output.tmp
Deletes the following files
- %WINDIR%\temp\nsg6588.tmp\brh.dat
- %WINDIR%\temp\nsg6588.tmp\brh.dll
- %WINDIR%\temp\nsg6588.tmp\md5dll.dll
- %WINDIR%\temp\nsg6588.tmp\system.dll
- %WINDIR%\temp\udd9d57.tmp
- %WINDIR%\temp\wjmb7d9.tmp
- %WINDIR%\c514922eeea2bdf372923f11bd310f42.xml
- %TEMP%\dc3f.tmp
- %TEMP%\dc4f.tmp-shm
- %TEMP%\dc4f.tmp
- %TEMP%\de34.tmp
- %TEMP%\de44.tmp-shm
- %TEMP%\de44.tmp
- %TEMP%\nsqdffa.tmp
- %TEMP%\nsv582f.tmp\get_local_output.tmp
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
- %APPDATA%\opera software\opera stable\local state
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert8.db
Network activity
Connects to
- 'ch#####ttechnology.com':80
TCP
HTTP GET requests
- http://ch#####ttechnology.com/installer/start?v=#################################################################################################################################################...
- http://ch#####ttechnology.com/web/log?ev#########################################################################################################################################################...
- http://ch#####ttechnology.com/installer/logging?ev###############################################################################################################################################...
- http://ch#####ttechnology.com/installer/progress?se##############################################################################################################################################...
- http://ch#####ttechnology.com/browserenhancer/update?v=##########################################################################################################################################...
- http://ch#####ttechnology.com/web/log?ev########################################################################################################################################################
- http://ch#####ttechnology.com/addon/mapping?v=##############################################################################################################################################
- http://ch#####ttechnology.com/installer/getTimestamp
- http://ch#####ttechnology.com/index.php?fi#######################################################################################################################################################...
- http://ch#####ttechnology.com/installer/finish?v=################################################################################################################################################...
HTTP POST requests
- http://ch#####ttechnology.com/installer/downloadsLog?un##########################################################
- http://ch#####ttechnology.com/installer/urlsLog?un######################################################################
UDP
- DNS ASK ch#####ttechnology.com
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe' --install
- '%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe'
- '%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe' --install_ff_cert
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start --' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete --' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create 5358012b64bd63da158060d513b962ee binpath= <DRIVERS>\5358012b64bd63da158060d513b962ee.sys DisplayName= 5358012b64bd63da158060d513b962ee type= kernel start= system group= PNP_TDI' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start 5358012b64bd63da158060d513b962ee' (with hidden window)
- '%ProgramFiles%\8aa047478af3bafbda66f9dc66d2ce3a\de562448b2bc8d5edb9c13f7b2448846.exe' --install' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' failure 8aa047478af3bafbda66f9dc66d2ce3a reset= 60 actions= restart/5000/restart/5000/restart/5000' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"
- '%WINDIR%\syswow64\net.exe' start --
- '%WINDIR%\syswow64\net1.exe' start --
- '%WINDIR%\syswow64\sc.exe' delete --
- '%WINDIR%\syswow64\sc.exe' create 5358012b64bd63da158060d513b962ee binpath= <DRIVERS>\5358012b64bd63da158060d513b962ee.sys DisplayName= 5358012b64bd63da158060d513b962ee type= kernel start= system group= PNP_TDI
- '%WINDIR%\syswow64\sc.exe' start 5358012b64bd63da158060d513b962ee
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONSTART /TN 8aa047478af3bafbda66f9dc66d2ce3a /TR "sc start 8aa047478af3bafbda66f9dc66d2ce3a" /RU SYSTEM /F
- '%WINDIR%\syswow64\sc.exe' failure 8aa047478af3bafbda66f9dc66d2ce3a reset= 60 actions= restart/5000/restart/5000/restart/5000
- '%WINDIR%\syswow64\schtasks.exe' /delete /F /tn c514922eeea2bdf372923f11bd310f42
- '%WINDIR%\syswow64\schtasks.exe' /create /xml "%WINDIR%\c514922eeea2bdf372923f11bd310f42.xml" /tn c514922eeea2bdf372923f11bd310f42
