Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\02428cf3-0242-8cf3-0242-02428cf30240
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %APPDATA%\descript.ion
- %APPDATA%\2588727647.js
- %APPDATA%\278913842
- %APPDATA%\default.br2
- %APPDATA%\vertical.br2
- %APPDATA%\tcunin64.wul
- %LOCALAPPDATA%\02428cf30.js
- %APPDATA%\d825a8e
- %APPDATA%\34ed97eb
- %TEMP%\cv-_zxa9.0.cs
- %TEMP%\cv-_zxa9.cmdline
- %TEMP%\cv-_zxa9.out
- %TEMP%\cscf4c9.tmp
- %TEMP%\resf4f9.tmp
- %TEMP%\cv-_zxa9.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024011920240120\index.dat
Deletes the following files
- %APPDATA%\d825a8e
- %APPDATA%\34ed97eb
- %TEMP%\resf4f9.tmp
- %TEMP%\cscf4c9.tmp
- %TEMP%\cv-_zxa9.pdb
- %TEMP%\cv-_zxa9.cmdline
- %TEMP%\cv-_zxa9.0.cs
- %TEMP%\cv-_zxa9.out
- %TEMP%\cv-_zxa9.dll
Moves the following files
- from %APPDATA%\2588727647.js to %APPDATA%\d825a8e
- from %APPDATA%\278913842 to %APPDATA%\34ed97eb
Moves itself
- from <Full path to file> to <Current directory>\66ba74bf
Deletes itself.
Network activity
Connects to
- 'ec###447.shop':443
- 'ec###447.cyou':443
- '9d###cce.shop':443
TCP
Other
- 'ec###447.shop':443
- '9d###cce.shop':443
UDP
- DNS ASK 92###cbe.shop
- DNS ASK 92###cbe.cyou
- DNS ASK 92###cbe.icu
- DNS ASK ec###447.shop
- DNS ASK ec###447.cyou
- DNS ASK ec###447.icu
- DNS ASK 9d###cce.shop
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\02428cf30.js" 229
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\02428cf30.js" 229' (with hidden window)
- '%WINDIR%\syswow64\vssadmin.exe' Delete Shadows /All /Quiet' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALg...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cv-_zxa9.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF4F9.tmp" "%TEMP%\CSCF4C9.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wscript.exe' 2588727647.js 229 "<Full path to file>"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALg...
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cv-_zxa9.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF4F9.tmp" "%TEMP%\CSCF4C9.tmp"
