Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\<File name>x
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\system
Modifies file system
Creates the following files
- <Current directory>\51fc3127e6f6e3
- %HOMEPATH%\desktop\pqdtmgey.log
- %HOMEPATH%\desktop\zzxjwjjg.log
- %HOMEPATH%\desktop\lzywgedn.log
- %TEMP%\otoqmg40sm.bat
- %TEMP%\fnxss6ugjf
- %HOMEPATH%\desktop\xzsaawsh.log
- %HOMEPATH%\desktop\fdbqkpio.log
- %HOMEPATH%\desktop\ogjftjyv.log
- %HOMEPATH%\desktop\xksvdcnd.log
- %HOMEPATH%\desktop\ccgohcrz.log
- %TEMP%\pdabhojjbp.bat
- %TEMP%\ietpiydfqk
- %HOMEPATH%\desktop\eqzkyueg.log
- %HOMEPATH%\desktop\ekrmnffa.log
- %HOMEPATH%\desktop\isgedwes.log
- %HOMEPATH%\desktop\fqglczfs.log
- %HOMEPATH%\desktop\jxzdfhdn.log
- nul
- %TEMP%\fwbpkcogdr.bat
- %TEMP%\3oc3kubsat
- <Current directory>\f3b6ecef712a24
- <Current directory>\spoolsv.exe
- %WINDIR%\inf\remoteaccess\51fc3127e6f6e3
- %WINDIR%\inf\remoteaccess\<File name>.exe
- %WINDIR%\policydefinitions\27d1bcfc3c54e0
- %WINDIR%\policydefinitions\system.exe
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\f3b6ecef712a24
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\spoolsv.exe
- %WINDIR%\media\51fc3127e6f6e3
- %WINDIR%\media\<File name>.exe
- %HOMEPATH%\desktop\otpbmsuz.log
- %HOMEPATH%\desktop\zoxptdok.log
Deletes the following files
- %TEMP%\3oc3kubsat
- %TEMP%\ietpiydfqk
- %TEMP%\fnxss6ugjf
Network activity
UDP
- DNS ASK 70#####m.nyashkoon.ru
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\spoolsv.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'<Current directory>\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>x" /sc MINUTE /mo 6 /tr "'%WINDIR%\Media\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\tXGl5KOL28.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\otOQMG40sM.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\pDaBHOJJBp.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\FwbpkcoGDr.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>x" /sc MINUTE /mo 13 /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>x" /sc MINUTE /mo 13 /tr "'<Full path to file>'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>x" /sc MINUTE /mo 12 /tr "'%WINDIR%\Media\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%WINDIR%\Media\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'%WINDIR%\PolicyDefinitions\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%WINDIR%\PolicyDefinitions\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'%WINDIR%\PolicyDefinitions\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>x" /sc MINUTE /mo 8 /tr "'%WINDIR%\inf\RemoteAccess\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%WINDIR%\inf\RemoteAccess\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>x" /sc MINUTE /mo 14 /tr "'%WINDIR%\inf\RemoteAccess\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\spoolsv.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\FwbpkcoGDr.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\pDaBHOJJBp.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\tXGl5KOL28.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\otOQMG40sM.bat"' (with hidden window)
