Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%WINDIR%\Migration\WTR\Idle.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%WINDIR%\WindowsUpdate\explorer.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"<SYSTEM32>\encapi\dwm.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\Users\Public\lsass.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%ALLUSERSPROFILE%\Microsoft\DbgClr\7.1\1033\winlogon.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\winlogon
Modifies file system
Creates the following files
- %WINDIR%\migration\wtr\idle.exe
- %WINDIR%\migration\wtr\6ccacd8608530f
- %WINDIR%\windowsupdate\explorer.exe
- %WINDIR%\windowsupdate\7a0fd90576e088
- %WINDIR%\syswow64\encapi\dwm.exe
- %WINDIR%\syswow64\encapi\6cb0b6c459d5d3
- C:\users\public\lsass.exe
- C:\users\public\6203df4a6bafc7
- %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\winlogon.exe
- %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\cc11b995f2a76d
- %TEMP%\gnbhjhs6zd
- %TEMP%\ajxmnj2l0v.bat
- nul
Deletes the following files
- %TEMP%\gnbhjhs6zd
Network activity
Connects to
- '83.##6.232.6':80
TCP
HTTP GET requests
- http://83.##6.232.6/Track8/vmtoAuthwptemp.php?w1#################################################################################################################################################...
- http://83.##6.232.6/Track8/vmtoAuthwptemp.php?y5#################################################################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\migration\wtr\idle.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\aJxmnj2l0v.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%WINDIR%\Migration\WTR\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\WindowsUpdate\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\encapi\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft\DbgClr\7.1\1033\winlogon.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\aJxmnj2l0v.bat"
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
