Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"C:\Documents and Settings\spoolsv.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\Documents and Settings\lsass.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%WINDIR%\msdfmap\explorer.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"C:\PerfLogs\Admin\dwm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<SYSTEM32>\C_500\winlogon.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\winlogon
Malicious functions
Injects code into
the following user processes:
- lsass.exe
Modifies file system
Creates the following files
- C:\documents and settings\spoolsv.exe
- C:\documents and settings\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- C:\documents and settings\lsass.exe
- C:\documents and settings\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- %WINDIR%\msdfmap\explorer.exe
- %WINDIR%\msdfmap\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- C:\perflogs\admin\dwm.exe
- C:\perflogs\admin\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- %WINDIR%\syswow64\c_500\winlogon.exe
- %WINDIR%\syswow64\c_500\cc11b995f2a76da408ea6a601e682e64743153ad
Network activity
Connects to
- 'cd#.##scordapp.com':443
- 'tc##.gov.tr':80
- 'tc##.gov.tr':443
- '13#.#81.31.150':80
TCP
Other
- 'cd#.##scordapp.com':443
- 'tc##.gov.tr':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK tc##.gov.tr
Miscellaneous
Creates and executes the following
- 'C:\documents and settings\lsass.exe'
- 'C:\documents and settings\lsass.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Documents and Settings\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Documents and Settings\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\msdfmap\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\PerfLogs\Admin\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\C_500\winlogon.exe'" /rl HIGHEST /f
