Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'msxfjorrswq' = '<SYSTEM32>\regsvr32.exe /s "%TEMP%\nso6C7A.tmp.dll"'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'msxfjorrswq' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\gpuknqjdfwi.dll"'
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Modifies file system
Creates the following files
- %TEMP%\nso6345.tmp\system.dll
- %TEMP%\nso6c7a.tmp.dll
- %WINDIR%\syswow64\bnsgcbcccht.exe
Deletes the following files
- %TEMP%\nso6345.tmp\system.dll
Moves the following files
- from %TEMP%\nso6c7a.tmp.dll to %WINDIR%\syswow64\gpuknqjdfwi.dll
Network activity
Connects to
- 'google.com':80
UDP
- DNS ASK cl###burner.net
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\gpuknqjdfwi.dll"
