Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'VersionRecover' = '%LOCALAPPDATA%\Microsoft\spoolsvc.exe'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\huty.exe
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\breakpadinjector.dll
- %TEMP%\zcubtxz5.4om\freebl3.dll
- %TEMP%\zcubtxz5.4om\ia2marshal.dll
- %TEMP%\zcubtxz5.4om\ldap60.dll
- %TEMP%\zcubtxz5.4om\ldif60.dll
- %TEMP%\zcubtxz5.4om\lgpllibs.dll
- %TEMP%\zcubtxz5.4om\libegl.dll
- %TEMP%\zcubtxz5.4om\mapiproxy.dll
- %TEMP%\zcubtxz5.4om\mapiproxy_inuse.dll
- %TEMP%\zcubtxz5.4om\mozglue.dll
- %TEMP%\zcubtxz5.4om\mozmapi32.dll
- %TEMP%\zcubtxz5.4om\mozmapi32_inuse.dll
- %TEMP%\zcubtxz5.4om\msvcp140.dll
- %TEMP%\zcubtxz5.4om\nss3.dll
- %TEMP%\zcubtxz5.4om\nssckbi.dll
- %TEMP%\zcubtxz5.4om\nssdbm3.dll
- %TEMP%\zcubtxz5.4om\prldap60.dll
- %TEMP%\zcubtxz5.4om\qipcap.dll
- %TEMP%\zcubtxz5.4om\softokn3.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\ucrtbase.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\7zipsfx.000\wale.exe
- %TEMP%\tmpa25c.tmp
- %TEMP%\zcubtxz5.4om\accessiblehandler.dll
- %TEMP%\zcubtxz5.4om\accessiblemarshal.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\zcubtxz5.4om\vcruntime140.dll
Deletes the following files
- %TEMP%\7zipsfx.000\huty.exe
- %TEMP%\7zipsfx.000\wale.exe
Network activity
TCP
HTTP GET requests
- http://45.##9.236.59/nkQpn6ojWUJ
- http://45.##9.236.59/0hOUNOmB68x0w2H2DEhvwu3tGJhvVP/l
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\wale.exe'
- '%LOCALAPPDATA%\microsoft\spoolsvc.exe'
- '%TEMP%\7zipsfx.000\huty.exe' ' (with hidden window)
- '%TEMP%\7zipsfx.000\wale.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & del "%TEMP%\7ZipSfx.000\wale.exe" & %LOCALAPPDATA%\Microsoft\spoolsvc.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c choice /C Y /N /D Y /T 3 & del "%TEMP%\7ZipSfx.000\wale.exe" & %LOCALAPPDATA%\Microsoft\spoolsvc.exe
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
