Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<Current directory>\taskhost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\taskhost.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\totalcmd\LANGUAGE\iexplore.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\taskhost.exe", "C:\totalcmd\LANGUAGE\iexplore.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\winlogon.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Current directory>\taskhost.exe", "C:\totalcmd\LANGUAGE\iexplore.exe", "C:\MSOCache\All Use...
Creates or modifies the following files
- <SYSTEM32>\tasks\gnyutaskhost
- <SYSTEM32>\tasks\wzwytaskhost
- <SYSTEM32>\tasks\hrqptaskhost
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\ugw6iexplore
- <SYSTEM32>\tasks\bm9miexplore
- <SYSTEM32>\tasks\c0xkiexplore
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\nf08winlogon
- <SYSTEM32>\tasks\aiqawinlogon
- <SYSTEM32>\tasks\stzvwinlogon
- <SYSTEM32>\tasks\winlogon
Modifies file system
Creates the following files
- <Current directory>\taskhost.exe
- <Current directory>\b75386f1303e64
- C:\totalcmd\language\iexplore.exe
- C:\totalcmd\language\9db6e019d4f04e
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\winlogon.exe
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\cc11b995f2a76d
Network activity
Connects to
- '18#.#20.249.39':80
TCP
HTTP GET requests
- http://18#.#20.249.39/imagesecurePublicCentral.php?fF############################################################################################################################################...
Miscellaneous
Creates and executes the following
- '<Current directory>\taskhost.exe'
- '<Current directory>\taskhost.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "GNYutaskhost" /sc MINUTE /mo 12 /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WZWytaskhost" /sc ONLOGON /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "HrQPtaskhost" /sc ONSTART /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc MINUTE /mo 5 /tr "'<Current directory>\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "UGW6iexplore" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "C0XKiexplore" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "bM9miexplore" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "nF08winlogon" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "aIQawinlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "STZvwinlogon" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /f
