Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Modifies file system
Creates the following files
- C:\del.bat
- nul
- %TEMP%\d06354ac49a8186aeabde80f811ea13c
Deletes the following files
- %WINDIR%\Prefetch\1.EXE-BF9D2CEF.pf
- %WINDIR%\Prefetch\SETUP.EXE-7C026C7F.pf
- %WINDIR%\Prefetch\SETUP.EXE-D0F6149E.pf
- %WINDIR%\Prefetch\SETUP.EXE-F034C93C.pf
- %WINDIR%\Prefetch\SETUP_WM.EXE-D33FD27D.pf
- %WINDIR%\Prefetch\SPPSVC.EXE-B0F8131B.pf
- %WINDIR%\Prefetch\TEST_MSVCP100D_X64.EXE-24890C8A.pf
- %WINDIR%\Prefetch\SCHTASKS.EXE-5CA45734.pf
- %WINDIR%\Prefetch\SC.EXE-945D79AE.pf
- %WINDIR%\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf
- %WINDIR%\Prefetch\TASKENG.EXE-48D4E289.pf
- %WINDIR%\Prefetch\TASKHOST.EXE-7238F31D.pf
- %WINDIR%\Prefetch\TEST_MSVCP100.EXE-93B75347.pf
- %WINDIR%\Prefetch\TEST_MSVCP100.EXE-D47FF5F1.pf
- %WINDIR%\Prefetch\STEAMWEBHELPER.EXE-93613764.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-80F4A784.pf
- %WINDIR%\Prefetch\OPERA.EXE-9DD4E019.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-7AC6742A.pf
- %WINDIR%\Prefetch\POWERPNT.EXE-158B76A4.pf
- %WINDIR%\Prefetch\OSE.EXE-51C16F0E.pf
- %WINDIR%\Prefetch\OSE.EXE-533D8AC9.pf
- %WINDIR%\Prefetch\OSE00001.EXE-3DA4B844.pf
- %WINDIR%\Prefetch\OSPPSVC.EXE-E53D3CC0.pf
- %WINDIR%\Prefetch\PCAUI.EXE-3E82C312.pf
- %WINDIR%\Prefetch\REGEDIT.EXE-90FEEA06.pf
- %WINDIR%\Prefetch\REGTLIB.EXE-E21980A2.pf
- %WINDIR%\Prefetch\REGSVCS.EXE-A54AD617.pf
- %WINDIR%\Prefetch\ReadyBoot\Trace3.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace4.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace5.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace6.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace7.fx
- %WINDIR%\Prefetch\PfSvPerfStats.bin
- %WINDIR%\Prefetch\RDRCEF.EXE-5852A8DE.pf
- %WINDIR%\Prefetch\OPERA_CRASHREPORTER.EXE-E30EBED0.pf
- %WINDIR%\Prefetch\TEST_MSVCP100_X64.EXE-6E02575E.pf
- %WINDIR%\Prefetch\TEST_MSVCP110D.EXE-DD6C4BD2.pf
- %WINDIR%\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
- %WINDIR%\Prefetch\UNINS000.EXE-53663602.pf
- %WINDIR%\Prefetch\VS7JIT.EXE-AEF49C84.pf
- %WINDIR%\Prefetch\VSSVC.EXE-B8AFC319.pf
- %WINDIR%\Prefetch\WERFAULT.EXE-E69F695A.pf
- %WINDIR%\Prefetch\TEST_MSVCP90_X64.EXE-CF1ECFBE.pf
- %WINDIR%\Prefetch\TRIGGERKMS.EXE-7E8EDFDC.pf
- %WINDIR%\Prefetch\WERMGR.EXE-0F2AC88C.pf
- %WINDIR%\Prefetch\WINWORD.EXE-778F7C2B.pf
- %WINDIR%\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
- %WINDIR%\Prefetch\WMIPRVSE.EXE-1628051C.pf
- %WINDIR%\Prefetch\WMIPRVSE.EXE-6768A320.pf
- %WINDIR%\Prefetch\WMPLAYER.EXE-26C72A86.pf
- %WINDIR%\Prefetch\WEVTUTIL.EXE-400D93E8.pf
- %WINDIR%\Prefetch\WEVTUTIL.EXE-EF5861C4.pf
- %WINDIR%\Prefetch\TEST_MSVCP110.EXE-F929C484.pf
- %WINDIR%\Prefetch\TEST_MSVCP110.EXE-39F2672E.pf
- %WINDIR%\Prefetch\TEST_MSVCP140XP.EXE-6D280B1D.pf
- %WINDIR%\Prefetch\TEST_MSVCP110D_X64.EXE-6AFAA41F.pf
- %WINDIR%\Prefetch\TEST_MSVCP110_X64.EXE-600927FB.pf
- %WINDIR%\Prefetch\TEST_MSVCP120.EXE-5E9C35C1.pf
- %WINDIR%\Prefetch\TEST_MSVCP120.EXE-9F64D86B.pf
- %WINDIR%\Prefetch\TEST_MSVCP140_X64.EXE-361D99D2.pf
- %WINDIR%\Prefetch\TEST_MSVCP110D.EXE-6C7E6CB8.pf
- %WINDIR%\Prefetch\TEST_MSVCP90.EXE-29C5DA51.pf
- %WINDIR%\Prefetch\TEST_MSVCP120D.EXE-5E6BDB07.pf
- %WINDIR%\Prefetch\TEST_MSVCP140.EXE-6A49BAE5.pf
- %WINDIR%\Prefetch\TEST_MSVCP140D.EXE-606AF971.pf
- %WINDIR%\Prefetch\TEST_MSVCP140D_X64.EXE-3E4F6ADE.pf
- %WINDIR%\Prefetch\TEST_MSVCP140D_XP.EXE-B04BC36C.pf
- %WINDIR%\Prefetch\TEST_MSVCP120D.EXE-ED7DFBED.pf
- %WINDIR%\Prefetch\TEST_MSVCP120D_X64.EXE-B16C3BB4.pf
- %WINDIR%\Prefetch\TEST_MSVCP120XP.EXE-D7D05439.pf
- %WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
- %WINDIR%\Prefetch\NGEN.EXE-EC3F9239.pf
- %WINDIR%\Prefetch\NGEN.EXE-AE594A6B.pf
- %WINDIR%\Prefetch\DEXPLORE.EXE-1749D792.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-5E46FA0D.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-766398D2.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-7FAA2E4C.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-861F96F8.pf
- %WINDIR%\Prefetch\DBGCLR.EXE-AD18E06E.pf
- %WINDIR%\Prefetch\FLASHPLAYERUPDATESERVICE.EXE-216D9C35.pf
- %WINDIR%\Prefetch\CONTROL.EXE-817F8F1D.pf
- %WINDIR%\Prefetch\DOTNETFX.EXE-FE16BE11.pf
- %WINDIR%\Prefetch\DRVINST.EXE-4CB4314A.pf
- %WINDIR%\Prefetch\EXCEL.EXE-53A22446.pf
- %WINDIR%\Prefetch\EXPLORER.EXE-A80E4F97.pf
- %WINDIR%\Prefetch\FIREFOX.EXE-18ACFCFF.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-D58DA3A6.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-B2EB1806.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-ECB71776.pf
- %WINDIR%\Prefetch\CMD.EXE-4A81B364.pf
- %WINDIR%\Prefetch\AgGlUAD_S-1-5-21-1960123792-2022915161-3775307078-1001.db
- %WINDIR%\Prefetch\ADDINUTIL.EXE-FEF23417.pf
- %WINDIR%\Prefetch\AgAppLaunch.db
- %WINDIR%\prefetch\agcx_sc4.db
- %WINDIR%\Prefetch\AgGlFaultHistory.db
- %WINDIR%\Prefetch\AgGlFgAppHistory.db
- %WINDIR%\Prefetch\CONHOST.EXE-1F3E9D7E.pf
- %WINDIR%\Prefetch\IEXPLORE.EXE-4B6C9213.pf
- %WINDIR%\Prefetch\ACRORD32.EXE-ACF2947D.pf
- %WINDIR%\prefetch\agrobust.db
- %WINDIR%\Prefetch\ARH.EXE-F07E6C2C.pf
- %WINDIR%\Prefetch\ASPNET_REGIIS.EXE-B76F1AD7.pf
- %WINDIR%\prefetch\AUDIODG.EXE-BDFD3029.pf
- %WINDIR%\Prefetch\BCSSYNC.EXE-3F6C64A2.pf
- %WINDIR%\Prefetch\AgGlUAD_P_S-1-5-21-1960123792-2022915161-3775307078-1001.db
- %WINDIR%\Prefetch\AgGlGlobalHistory.db
- %WINDIR%\Prefetch\DEFRAG.EXE-588F90AD.pf
- %WINDIR%\Prefetch\INSTALL.EXE-455F2D9B.pf
- %WINDIR%\Prefetch\MSI419F.TMP-B24CC418.pf
- %WINDIR%\Prefetch\MSIDF38.TMP-4231CF8D.pf
- %WINDIR%\Prefetch\MSIEB32.TMP-A0D60608.pf
- %WINDIR%\Prefetch\MSIEXEC.EXE-A2D55CB6.pf
- %WINDIR%\Prefetch\MSIEXEC.EXE-E09A077A.pf
- %WINDIR%\Prefetch\MSDTC.EXE-CC1DEC77.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-57D17DAF.pf
- %WINDIR%\Prefetch\MSI6837.TMP-63DEBE2C.pf
- %WINDIR%\Prefetch\MSIF1A9.TMP-FA1CA0E9.pf
- %WINDIR%\Prefetch\MSTSC.EXE-5283258E.pf
- %WINDIR%\Prefetch\MSTSC.EXE-76A46E8A.pf
- %WINDIR%\Prefetch\NETSH.EXE-F1B6DA12.pf
- %WINDIR%\Prefetch\NGEN.EXE-7900743E.pf
- %WINDIR%\Prefetch\MSOHTMED.EXE-35A8CA79.pf
- %WINDIR%\Prefetch\MSOHTMED.EXE-68E5AB1E.pf
- %WINDIR%\Prefetch\MSOXMLED.EXE-E473A01D.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-C3C515BD.pf
- %WINDIR%\Prefetch\MSCONFIG.EXE-3A52734E.pf
- %WINDIR%\Prefetch\IPCONFIG.EXE-912F3D5B.pf
- %WINDIR%\Prefetch\KMSNANO_SETUP.EXE-631A87C6.pf
- %WINDIR%\Prefetch\KMSNANO_SETUP.TMP-11A1562C.pf
- %WINDIR%\Prefetch\LAUNCHER.EXE-E41E51EE.pf
- %WINDIR%\prefetch\layout.ini
- %WINDIR%\Prefetch\LOGONUI.EXE-09140401.pf
- %WINDIR%\Prefetch\MANAGEDDBGCA.EXE-6EA1439B.pf
- %WINDIR%\Prefetch\JAVAW.EXE-DCCF0AB8.pf
- %WINDIR%\Prefetch\MDM.EXE-EA9906DF.pf
- %WINDIR%\Prefetch\MIGPOLWIN.EXE-79E606FC.pf
- %WINDIR%\Prefetch\MMC.EXE-53159585.pf
- %WINDIR%\Prefetch\MMC.EXE-F39CDED6.pf
- %WINDIR%\Prefetch\MMC.EXE-F5DC4F82.pf
- %WINDIR%\Prefetch\MOFCOMP.EXE-8FE3D558.pf
- %WINDIR%\Prefetch\MOFCOMP.EXE-FDE76EFC.pf
- %WINDIR%\Prefetch\MICROSOFT TOOLKIT.EXE-9DAE6A40.pf
- %WINDIR%\Prefetch\WMPNSCFG.EXE-FC0D39BF.pf
- %WINDIR%\Prefetch\_IU14D2N.TMP-74616CED.pf
Moves itself
- from <Full path to file> to <Current directory>\µü°ïГç»ð.exe
Network activity
TCP
- '3a#################74430ba49dba5.dwa5w65asdwq23asdwq21weq3awqweq.com':50554
UDP
- DNS ASK 3a#################74430ba49dba5.dwa5w65asdwq23asdwq21weq3awqweq.com
- DNS ASK 72###################29451913f4ecc7af039.dwa5w65asdwq23asdwq21weq3awqweq.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c C:\del.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /creg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /va /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /crmdir /s/q %USERPROFILE%\Recent' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /cFOR /F %%I IN ('WEVTUTIL EL') DO (WEVTUTIL CL %%I)' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\cmd.exe' /c C:\del.bat
- '%WINDIR%\syswow64\cmd.exe' /creg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /va /f
- '%WINDIR%\syswow64\cmd.exe' /crmdir /s/q %USERPROFILE%\Recent
- '%WINDIR%\syswow64\cmd.exe' /cFOR /F %%I IN ('WEVTUTIL EL') DO (WEVTUTIL CL %%I)
- '%WINDIR%\syswow64\choice.exe' /t 3 /d y /n
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /va /f
