Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Intel HD Graphics Drivers for Windows(R)' = '%PROGRAMDATA%\IntelCore\IntelConfigService.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Intel HD Graphics Drivers for Windows(R)' = '%PROGRAMDATA%\IntelCore\IntelConfigService.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Intel HD Graphics Drivers for Windows(R)' = '%PROGRAMDATA%\IntelCore\IntelConfigService.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\intelhdgraphicsdriversforwindows(r).lnk
Modifies file system
Creates the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- %PROGRAMDATA%\intelcore\applicationsframehost.exe
- %PROGRAMDATA%\intelcore\wrap.exe
- %PROGRAMDATA%\intelcore\config.json
- %PROGRAMDATA%\intelcore\intelconfigservice.exe
- %PROGRAMDATA%\systemnetwork\xcoremanagment.exe
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\676u10v8\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\mrt1g30j\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\b4y841w7\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\o1hztvzc\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %PROGRAMDATA%\commonsfiles\cpu_info.docx
- %PROGRAMDATA%\smartscreen\appditel.exe
Sets the 'hidden' attribute to the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\o1hztvzc\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\b4y841w7\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\mrt1g30j\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\676u10v8\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- %PROGRAMDATA%\intelcore\intelconfigservice.exe
- %PROGRAMDATA%\intelcore\wrap.exe
- %PROGRAMDATA%\intelcore\applicationsframehost.exe
- %PROGRAMDATA%\commonsfiles\cpu_info.docx
- %PROGRAMDATA%\smartscreen\appditel.exe
Network activity
TCP
HTTP GET requests
- http://92.##6.76.95/UserBuild/x64/Files/xCoreManagment.exe
- http://92.##6.76.95/UserBuild/x64/Files/IntelConfigService.exe
- http://92.##6.76.95/UserBuild/x64/Files/config.json
- http://92.##6.76.95/UserBuild/x64/Files/Wrap.exe
- http://92.##6.76.95/UserBuild/x64/Files/ApplicationsFrameHost.exe
- http://92.##6.76.95/UserBuild/x64/Files/cpu_info.docx
- http://92.##6.76.95/UserBuild/appditel.exe
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\systemnetwork\xcoremanagment.exe'
- '%PROGRAMDATA%\intelcore\intelconfigservice.exe'
- '%PROGRAMDATA%\intelcore\wrap.exe'
- '%PROGRAMDATA%\intelcore\applicationsframehost.exe' --daemonized
- '%PROGRAMDATA%\smartscreen\appditel.exe'
- '%PROGRAMDATA%\intelcore\wrap.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SystemNetwork /deny "Administrators:(R,REA,RA))"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SystemNetwork /deny "Users:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SystemNetwork /deny "%username%:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\IntelCore /deny "Administrators:(R,REA,RA))"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\IntelCore /deny "Users:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\IntelCore /deny "%username%:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SmartScreen /deny "Administrators:(R,REA,RA))"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SmartScreen /deny "Users:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SmartScreen /deny "%username%:(R,REA,RA)"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\cmd.exe' /c "%PROGRAMDATA%\IntelCore\ApplicationsFrameHost.exe" --daemonized
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SystemNetwork /deny "Administrators:(R,REA,RA))"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SystemNetwork /deny "Users:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SystemNetwork /deny "%username%:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\IntelCore /deny "Administrators:(R,REA,RA))"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\IntelCore /deny "Users:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\IntelCore /deny "%username%:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SmartScreen /deny "Administrators:(R,REA,RA))"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SmartScreen /deny "Users:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\SmartScreen /deny "%username%:(R,REA,RA)"
- '%WINDIR%\syswow64\icacls.exe' %PROGRAMDATA%\IntelCore /deny "user:(R,REA,RA)"
