Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\bin\loading.gif
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vm3d.cat
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vm3d.inf
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmx_svga.cat
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmx_svga.inf
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vm3dgl.dll
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vm3dmp.sys
- %TEMP%\7zipsfx.000\bin\bluebird.js
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vm3dum.dll
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmwogl32.dll
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmx_fb.dll
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmx_mode.dll
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmx_svga.sys
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vmx_svgaver.dll
- %TEMP%\7zipsfx.000\bin\tools\modules\clientid.js
- %TEMP%\7zipsfx.000\bin\tools\driverpack-wget.exe
- %TEMP%\7zipsfx.000\driverpack.exe
- %TEMP%\7zipsfx.000\bin\tools\driverpack-notifier.exe
- %TEMP%\7zipsfx.000\bin\tools\dpinst64.exe
- %TEMP%\7zipsfx.000\bin\tools\dpinst.exe
- %TEMP%\7zipsfx.000\bin\med_logo_dark_new.png
- %TEMP%\7zipsfx.000\bin\tools\icon.ico
- %TEMP%\7zipsfx.000\bin\tools\init.cmd
- %TEMP%\7zipsfx.000\bin\tools\dpinst.xml
- %TEMP%\7zipsfx.000\bin\driverpack.html
- %TEMP%\7zipsfx.000\bin\styles.css
- nul
- %TEMP%\7zipsfx.000\drivers\dp_videos_others_18084\vmware\5x86\vm3dver.dll
- %TEMP%\7zipsfx.000\bin\tools\run.hta
- %TEMP%\7zipsfx.000\bin\language.js
- %TEMP%\7zipsfx.000\bin\main.js
- %TEMP%\7zipsfx.000\bin\polyfills.js
- %TEMP%\7zipsfx.000\bin\languages\ru.js
- %TEMP%\7zipsfx.000\bin\tools\start.js
- %TEMP%\7zipsfx.000\bin\tools\patch.reg
- %TEMP%\7zipsfx.000\bin\globe.png
- %TEMP%\7zipsfx.000\bin\languages\en.js
- %APPDATA%\drpnano\logs\log___2024-04-14-14-52-35.html
Network activity
Connects to
- 'up###e.drp.su':80
- 'mc.yandex.ru':443
- 'go#####a###ytics.com':80
TCP
HTTP GET requests
- http://up###e.drp.su/nano/
- http://www.go#####a###ytics.com/collect
- http://www.go#####a###ytics.com/collect?v=#######################################################################################################################################################...
Other
- 'mc.yandex.ru':443
UDP
- DNS ASK up###e.drp.su
- DNS ASK mc.yandex.ru
- DNS ASK go#####a###ytics.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\7ZipSfx.000\bin\tools\start.js" ""%TEMP%\7ZipSfx.000\DriverPack.exe" --sfx "<File name>.exe""
- '%TEMP%\7zipsfx.000\driverpack.exe' --sfx <File name>.exe
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\7ZipSfx.000\bin\tools\start.js" ""%TEMP%\7ZipSfx.000\DriverPack.exe" --sfx "<File name>.exe""' (with hidden window)
- '%TEMP%\7zipsfx.000\driverpack.exe' --sfx <File name>.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c Tools\init.cmd "%TEMP%\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "<File name>.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c Tools\init.cmd "%TEMP%\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "<File name>.exe"
- '%WINDIR%\syswow64\reg.exe' import %TEMP%\7ZipSfx.000\bin\tools\\patch.reg
- '<SYSTEM32>\reg.exe' import %TEMP%\7ZipSfx.000\bin\tools\\patch.reg
- '%WINDIR%\syswow64\mshta.exe' "%TEMP%\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "<File name>.exe"
