Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'InstallVable' = '%WINDIR%\Windows Driver Foundation Update Check (WDF).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'InstallPathingMinersterstvo' = '%WINDIR%\Speen\Integrated Clock Controller Service - ICCS.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Driver Foundation Update Check (WDF)' = '%TEMP%\Microsoft Community Version.exe'
Modifies file system:
Creates the following files:
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %APPDATA%\ptt1782937022\Infomation.txt
- %APPDATA%\ptt1782937022\Main\forms.txt
- %APPDATA%\ptt1782937022\Main\cookies.txt
- %TEMP%\{a8446353}.txt-shm
- %TEMP%\{a8446353}.txt
- <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe.manifest.__tmp__
- <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe.__tmp__
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\Manifests\lovean.exe_0x11de84009af0fa48d7987ed962e7e474.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\lovean.exe\lovean.exe.manifest.__tmp__
- <LS_APPDATA>\SwDf\Cert\2.4.1\xsandbox.bin.__tmp__
- %HOMEPATH%\Start Menu\Programs\Setup Software\Удалить Setup Software.lnk
- %ProgramFiles%\Setup Software\Uninstall\IRIMG3.JPG
- %ProgramFiles%\Setup Software\Uninstall\IRIMG2.JPG
- %ProgramFiles%\Setup Software\Uninstall\IRIMG1.JPG
- %APPDATA%\ptt1782937022\Screenshot.bmp
- %WINDIR%\Speen\Integrated Clock Controller Service - ICCS.exe
- %APPDATA%\Microsoft Community Version.exe
- %ProgramFiles%\Setup Software\Uninstall\uninstall.xml
- %ProgramFiles%\Setup Software\lua5.1.dll
- %ProgramFiles%\Setup Software\uninstall.exe
- %ProgramFiles%\Setup Software\Uninstall\uninstall.dat
- %ProgramFiles%\Setup Software\Uninstall\uni3.tmp
- %WINDIR%\Windows Driver Foundation Update Check (WDF).exe
- %WINDIR%\criorr.exe
- %TEMP%\_ir_sf_temp_0\Paomedia-Small-N-Flat-Bitcoin.ico
- %TEMP%\_ir_sf_temp_0\IRIMG3.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %APPDATA%\Windows Corporation Driver Check.exe
- %APPDATA%\zp1782937022.zip
Deletes the following files:
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %ProgramFiles%\Setup Software\Uninstall\uni3.tmp
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG3.JPG
- %TEMP%\_ir_sf_temp_0\Paomedia-Small-N-Flat-Bitcoin.ico
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe
- <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe.manifest
- <LS_APPDATA>\SwDf\Cert\2.4.1\xsandbox.bin
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\lovean.exe\lovean.exe.manifest
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\Manifests\lovean.exe_0x11de84009af0fa48d7987ed962e7e474.1.manifest
- %TEMP%\{a8446353}.txt-shm
- %TEMP%\{a8446353}.txt
Moves the following files:
- from <LS_APPDATA>\SwDf\Cert\2.4.1\xsandbox.bin.__tmp__ to <LS_APPDATA>\SwDf\Cert\2.4.1\xsandbox.bin
- from %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\lovean.exe\lovean.exe.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\lovean.exe\lovean.exe.manifest
- from %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\Manifests\lovean.exe_0x11de84009af0fa48d7987ed962e7e474.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\Manifests\lovean.exe_0x11de84009af0fa48d7987ed962e7e474.1.manifest
- from <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe.__tmp__ to <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe
- from <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe.manifest.__tmp__ to <LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe.manifest
Substitutes the following files:
- <LS_APPDATA>\SwDf\Cert\2.4.1\xsandbox.bin.__tmp__
- <LS_APPDATA>\SwDf\Cert\2.4.1\xsandbox.bin
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\lovean.exe\lovean.exe.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\lovean.exe\lovean.exe.manifest
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\Manifests\lovean.exe_0x11de84009af0fa48d7987ed962e7e474.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xCE91FBC494CA2CCC\sxs\Manifests\lovean.exe_0x11de84009af0fa48d7987ed962e7e474.1.manifest
- %TEMP%\{a8446353}.txt
- %TEMP%\{a8446353}.txt-shm
Network activity:
Connects to:
- 'az######ki.tmp.fstest.ru':80
- 'go#.gl':443
- 'ev######ar.tmp.fstest.ru':80
TCP:
HTTP GET requests:
- http://az######ki.tmp.fstest.ru/vl/criorr.jpg
- http://az######ki.tmp.fstest.ru/vl/Windows%20Driver%20Foundation%20Update%20Check%20(WDF).jpg
HTTP POST requests:
- http://ev######ar.tmp.fstest.ru/api/gate.get?p1################################
UDP:
- DNS ASK az######ki.tmp.fstest.ru
- DNS ASK go#.gl
- DNS ASK ev######ar.tmp.fstest.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Qt5QWindowIcon' WindowName: ''
- ClassName: 'Qt5QWindowToolSaveBits' WindowName: ''
Creates and executes the following:
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1944610 "__IRAFN:<Full path to file>" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%APPDATA%\Windows Corporation Driver Check.exe'
- '<LS_APPDATA>\SwDf\Cert\2.4.1\local\stubexe\0x3766A13E71C62B85\2.exe'
