Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\folder7_77\ovhqpopsdi.bst
- %TEMP%\folder7_77\ulrpmt.icm
- %TEMP%\folder7_77\ectva.bin
- %TEMP%\folder7_77\tkqntcu.docx
- %TEMP%\folder7_77\itlijqw.dll
- %TEMP%\folder7_77\fstq.msc
- %TEMP%\folder7_77\psihwqfwf.ini
- %TEMP%\folder7_77\pbmlrxqnw.xl
- %TEMP%\folder7_77\bounwqtvk.msc
- %TEMP%\folder7_77\oqpvcgf.msc
- %TEMP%\folder7_77\nmkiegrb.icm
- %TEMP%\folder7_77\iuhj.jpg
- %TEMP%\folder7_77\aqckfi.xml
- %TEMP%\folder7_77\gxhsitsfi.txt
- %TEMP%\folder7_77\xdvxkbifea.bmp
- %TEMP%\folder7_77\toowhapo.ini
- %TEMP%\folder7_77\uddkef.jpg
- %TEMP%\folder7_77\tgafjxrft.icm
- %TEMP%\folder7_77\apsreor.jpg
- %TEMP%\folder7_77\dunndpu.docx
- %TEMP%\folder7_77\acadf.bin
- %TEMP%\folder7_77\xrkunsg.txt
- %TEMP%\folder7_77\ppkb.xls
- %TEMP%\folder7_77\muainhh.txt
- %TEMP%\folder7_77\uxafa.xls
- %TEMP%\folder7_77\ngsmhxfjp.dat
- %TEMP%\folder7_77\xovcws.docx
- %TEMP%\folder7_77\uugathorj.bin
- %TEMP%\folder7_77\gvkkmp.ini
- %TEMP%\folder7_77\bqfcpqond.xls
- %TEMP%\folder7_77\cjucl.mp3
- %TEMP%\folder7_77\ltedqe.dat
- %TEMP%\folder7_77\kecvomc-nnwmuf.xml.vbe
- %TEMP%\folder7_77\bctunnhtod.exe
- %TEMP%\folder7_77\vtacf.ini
- %TEMP%\folder7_77\cfsjgpnko.icm
- %TEMP%\folder7_77\sbhupokf.msc
- %TEMP%\folder7_77\qppngjuni.xls
- %TEMP%\folder7_77\dhwjvoogj.bin
- %TEMP%\folder7_77\wiwxqp.xl
- %TEMP%\folder7_77\akuj.exe
- %TEMP%\folder7_77\vnwehmtwa.bmp
- %TEMP%\folder7_77\vxbpwl.txt
- %TEMP%\folder7_77\rbbt.bin
- %TEMP%\folder7_77\kvidiocr.icm
- %TEMP%\folder7_77\odos.ini
- %TEMP%\folder7_77\kkndeadhjo.dll
- %TEMP%\folder7_77\gjgarexf.bin
- %TEMP%\folder7_77\jgqxh.ppt
- %TEMP%\folder7_77\pbtp.icm
- %TEMP%\folder7_77\toguebnkj.dat
- %TEMP%\folder7_77\wsnjul.bmp
- %TEMP%\folder7_77\tfht.msc
- %TEMP%\folder7_77\uodrp.dll
- %TEMP%\folder7_77\vfnmu.msc
- %TEMP%\folder7_77\ojoipkq.bmp
- %TEMP%\folder7_77\lmtwnllsfi.xls
- %TEMP%\folder7_77\upmei.bin
- %TEMP%\folder7_77\frklcj.bin
- %HOMEPATH%\temp\rbbt.bin
Sets the 'hidden' attribute to the following files
- %TEMP%\folder7_77\bctunnhtod.exe
Network activity
Connects to
- '45.##.253.146':5439
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\folder7_77\bctunnhtod.exe' ltedqe.dat
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %TEMP%\Folder7_77' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionProcess 'RegSvcs.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '.vbs'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '.vbe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '*.vbs'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '*.vbe'' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wscript.exe' kecvomc-nnwmuf.xml.vbe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %TEMP%\Folder7_77
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '.vbs'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '.vbe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '*.vbs'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' powershell -Command Add-MpPreference -ExclusionExtension '*.vbe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension *.vbs
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionProcess RegSvcs.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension .vbe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension .vbs
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension *.vbe
