Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CreateSvcRpc_795417] 'ImagePath' = 'cmd /c start C://XXEmulator.exe'
Creates the following services
- 'CreateSvcRpc_795417' cmd /c start C://XXEmulator.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- C:\selfstartuptask.ps1
- C:\xxemulator.exe
Network activity
Connects to
- '10#.#2.76.102':14992
TCP
Other
- '10#.#2.76.102':14992
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "C:\SelfStartupTask.ps1"
- 'C:\xxemulator.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c start C://XXEmulator.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "C:\SelfStartupTask.ps1"' (with hidden window)
