Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\rasautou\dwm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%WINDIR%\twain_32\lsass.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"<SYSTEM32>\comexp\wininit.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'services' = '"C:\Far2\Addons\XLat\Russian\services.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\RESAMPLEDMO\csrss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"<SYSTEM32>\iesysprep\wininit.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<SYSTEM32>\C_G18030\taskhost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"C:\Far2\Documentation\rus\taskhost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'schtasks' = '"%ProgramFiles%\ntrtscan\schtasks.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"<Current directory>\smss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\charmap\dwm.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\schtasks
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\smss
Modifies file system
Creates the following files
- %WINDIR%\syswow64\rasautou\dwm.exe
- <Current directory>\69ddcba757bf72f7d36c464c71f42baab150b2b9
- <Current directory>\smss.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\101b941d020240259ca4912829b53995ad543df6
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe
- %ProgramFiles%\ntrtscan\3a6fe29a7ceee6587669798812d4baccab0fb913
- %ProgramFiles%\ntrtscan\schtasks.exe
- C:\far2\documentation\rus\b75386f1303e64d8139363b71e44ac16341adf4e
- C:\far2\documentation\rus\taskhost.exe
- %WINDIR%\syswow64\c_g18030\b75386f1303e64d8139363b71e44ac16341adf4e
- %WINDIR%\syswow64\c_g18030\taskhost.exe
- %WINDIR%\syswow64\iesysprep\560854153607923c4c5f107085a7db67be01f252
- %WINDIR%\syswow64\iesysprep\wininit.exe
- %WINDIR%\syswow64\resampledmo\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %WINDIR%\syswow64\resampledmo\csrss.exe
- C:\far2\addons\xlat\russian\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
- C:\far2\addons\xlat\russian\services.exe
- %WINDIR%\syswow64\comexp\560854153607923c4c5f107085a7db67be01f252
- %WINDIR%\syswow64\comexp\wininit.exe
- %WINDIR%\twain_32\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- %WINDIR%\twain_32\lsass.exe
- %WINDIR%\syswow64\rasautou\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- %WINDIR%\syswow64\charmap\dwm.exe
- %WINDIR%\syswow64\charmap\6cb0b6c459d5d3455a3da700e713f2e2529862ff
Network activity
Connects to
- 'xi####st.ddns.net':80
UDP
- DNS ASK xi####st.ddns.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\c_g18030\taskhost.exe'
- '<Full path to file>' ' (with hidden window)
- '%WINDIR%\syswow64\c_g18030\taskhost.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\rasautou\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%WINDIR%\twain_32\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<SYSTEM32>\comexp\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Far2\Addons\XLat\Russian\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\RESAMPLEDMO\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<SYSTEM32>\iesysprep\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<SYSTEM32>\C_G18030\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'%ProgramFiles%\ntrtscan\schtasks.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\charmap\dwm.exe'" /rl HIGHEST /f
