Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<SYSTEM32>\cabview\taskhost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"%ProgramFiles%\mva\dwm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"<SYSTEM32>\umb\smss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles(x86)%\Mozilla Firefox\nss3\firefox.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'fortnite_inj' = '"C:\Far2\Addons\XLat\Russian\fortnite_inj.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'reviewWinhostreviewsavesDll' = '"%TEMP%\CVREAF2.tmp\reviewWinhostreviewsavesDll.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%ProgramFiles(x86)%\Mozilla Firefox\mozglue\firefox.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\Far2\PluginSDK\Headers.pas\audiodg.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Internet Explorer\msdbg2\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\audiodg.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\fortnite_inj
- <SYSTEM32>\tasks\reviewwinhostreviewsavesdll
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\iexplore
Modifies file system
Creates the following files
- %TEMP%\fortnite_inj.exe
- %ProgramFiles(x86)%\internet explorer\msdbg2\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles(x86)%\internet explorer\msdbg2\iexplore.exe
- C:\far2\pluginsdk\headers.pas\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- C:\far2\pluginsdk\headers.pas\audiodg.exe
- %ProgramFiles(x86)%\mozilla firefox\mozglue\0fc223bdacedc38dd6d2772d547ade1563558e92
- %ProgramFiles(x86)%\mozilla firefox\mozglue\firefox.exe
- %TEMP%\cvreaf2.tmp\ee04a4d7ad5681000eed13e269705e873cde9ed9
- %TEMP%\cvreaf2.tmp\reviewwinhostreviewsavesdll.exe
- C:\far2\addons\xlat\russian\ed54f2dd5d0ff42fbf68df8c5a86b30084c008fc
- C:\far2\addons\xlat\russian\fortnite_inj.exe
- %ProgramFiles(x86)%\mozilla firefox\nss3\0fc223bdacedc38dd6d2772d547ade1563558e92
- %ProgramFiles(x86)%\mozilla firefox\nss3\firefox.exe
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\886983d96e3d3e31032c679b2d4ea91b6c05afef
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\csrss.exe
- <SYSTEM32>\umb\69ddcba757bf72f7d36c464c71f42baab150b2b9
- <SYSTEM32>\umb\smss.exe
- %ProgramFiles%\mva\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- %ProgramFiles%\mva\dwm.exe
- <SYSTEM32>\cabview\b75386f1303e64d8139363b71e44ac16341adf4e
- <SYSTEM32>\cabview\taskhost.exe
- %TEMP%\reviewwinhostreviewsavesdll.exe
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\audiodg.exe
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
Network activity
Connects to
- '78.##.220.245':80
- '78.##.220.245':443
TCP
HTTP GET requests
- http://78.##.220.245/ws/proxy/geoUpdategenerator.php?UD##########################################################################################################################################...
Other
- '78.##.220.245':443
Miscellaneous
Creates and executes the following
- '%TEMP%\fortnite_inj.exe'
- '%TEMP%\reviewwinhostreviewsavesdll.exe'
- '%ProgramFiles(x86)%\internet explorer\msdbg2\iexplore.exe'
- '%TEMP%\reviewwinhostreviewsavesdll.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\msdbg2\iexplore.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<SYSTEM32>\cabview\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles%\mva\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<SYSTEM32>\umb\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Firefox\nss3\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "fortnite_inj" /sc ONLOGON /tr "'C:\Far2\Addons\XLat\Russian\fortnite_inj.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "reviewWinhostreviewsavesDll" /sc ONLOGON /tr "'%TEMP%\CVREAF2.tmp\reviewWinhostreviewsavesDll.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Firefox\mozglue\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\msdbg2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
