Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_1259489] 'ImagePath' = 'cmd /c C:\Users\Public\KK.exe'
Creates the following services
- 'CreateSvcRpc_1259489' cmd /c C:\Users\Public\KK.exe
- 'NAME01' C:\Zdd174cxy.sys
Modifies file system
Creates the following files
- C:\users\public\pro.exe
- C:\users\public\kk.exe
- %WINDIR%\temp\e_n60005\krnln.fnr
- %WINDIR%\temp\e_n60005\spec.fne
- %WINDIR%\temp\e_n60005\mp3.run
- C:\zdd174cxy.sys
Network activity
Connects to
- '10#.#06.189.92':80
TCP
HTTP GET requests
- http://10#.#06.189.92/a206.233.129.110.txt
- http://10#.#06.189.92/s206.233.129.110.txt
- http://10#.#06.189.92/KK.TXT
Miscellaneous
Creates and executes the following
- 'C:\users\public\pro.exe'
- 'C:\users\public\kk.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c tasklist | findstr /i 360tray.exe
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /i 360tray.exe
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\KK.exe
