Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\M9UY7K] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\M9UY7K] 'ImagePath' = '%WINDIR%\JETL3KTF.exe -2RXTQ'
Creates the following services
- 'M9UY7K' %WINDIR%\JETL3KTF.exe -2RXTQ
Modifies file system
Creates the following files
- %ProgramFiles%\k0y0k.exe
- %ProgramFiles%\myzopdb9stqq\astkah1wm4oi.exe
- %ProgramFiles%\exbhcec4x.bat
- %WINDIR%\jetl3ktf.exe
Sets the 'hidden' attribute to the following files
- <Full path to file>
Network activity
Connects to
- '58.#9.58.27':443
Miscellaneous
Searches for the following windows
- ClassName: 'EZUYIBOJCOUMMY' WindowName: 'pnzyuczsunkpfi'
- ClassName: 'easyclickplus3' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\k0y0k.exe' <Full path to file>
- '%ProgramFiles%\k0y0k.exe' W1YGFFK
- '%ProgramFiles%\k0y0k.exe' <Full path to file>' (with hidden window)
- '%ProgramFiles%\k0y0k.exe' W1YGFFK' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\EXBHCEC4X.bat""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\EXBHCEC4X.bat""
- '%WINDIR%\syswow64\sc.exe' create PQCS40N4QBinPath= "%ProgramFiles%\MYZOPDB9STQQ\ASTKAH1WM4OI.exe -start" type= own type= interact start= auto DisplayName= I311Q5WPW7T
- '%WINDIR%\syswow64\regsvr32.exe' /u /s shimgvw.dll
- '%WINDIR%\syswow64\regsvr32.exe' /u /s itss.dll
- '%WINDIR%\syswow64\regsvr32.exe' /u /s scrrun.dll
- '%WINDIR%\syswow64\regsvr32.exe' /u /s vbscript.dll
- '%WINDIR%\syswow64\regsvr32.exe' /s jscript.dll
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
- '%WINDIR%\syswow64\reg.exe' delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
