Technical Information
Modifies file system
Creates the following files
- %WINDIR%\ucyequ3nologc1fa.bat
- %WINDIR%\temp\tar274d.tmp
- %WINDIR%\temp\cab278d.tmp
- %WINDIR%\temp\tar278e.tmp
- %WINDIR%\temp\cab3cb4.tmp
- %WINDIR%\temp\tar3cb5.tmp
- %WINDIR%\temp\tar1207.tmp
- %WINDIR%\temp\cab273d.tmp
- %WINDIR%\temp\cab3d23.tmp
- %WINDIR%\temp\tar526b.tmp
- %WINDIR%\temp\cab52ba.tmp
- %WINDIR%\temp\tar52bb.tmp
- %WINDIR%\temp\cab6800.tmp
- %WINDIR%\temp\tar6811.tmp
- %WINDIR%\temp\tar3d24.tmp
- %WINDIR%\temp\cab525a.tmp
- %WINDIR%\temp\cab1206.tmp
- %WINDIR%\temp\tar11e6.tmp
- %WINDIR%\temp\cab11e5.tmp
- %WINDIR%\iqggkrnj2aedte3o.exe
- %WINDIR%\ucrtbased.dll
- %WINDIR%\vcruntime140d.dll
- %WINDIR%\qaq5fgsdrhfd7z3t.sys
- %WINDIR%\temp\cabe58d.tmp
- %WINDIR%\temp\tare58e.tmp
- %WINDIR%\0mvwxgrizg4ew5mna.exe
- %WINDIR%\temp\cabfb9f.tmp
- %WINDIR%\temp\cabfbfe.tmp
- %WINDIR%\temp\tarfbff.tmp
- %WINDIR%\temp\cab1145.tmp
- %WINDIR%\temp\tar1146.tmp
- %WINDIR%\temp\cab1195.tmp
- %WINDIR%\temp\tar11a5.tmp
- %WINDIR%\temp\tarfba0.tmp
- %WINDIR%\temp\caba984.tmp
- %WINDIR%\temp\tara985.tmp
Sets the 'hidden' attribute to the following files
- %WINDIR%\ucyequ3nologc1fa.bat
- %WINDIR%\0mvwxgrizg4ew5mna.exe
- %WINDIR%\iqggkrnj2aedte3o.exe
- %WINDIR%\ucrtbased.dll
- %WINDIR%\vcruntime140d.dll
- %WINDIR%\qaq5fgsdrhfd7z3t.sys
Deletes the following files
- %WINDIR%\temp\cabe58d.tmp
- %WINDIR%\temp\tar6811.tmp
- %WINDIR%\temp\cab6800.tmp
- %WINDIR%\temp\tar52bb.tmp
- %WINDIR%\temp\cab52ba.tmp
- %WINDIR%\temp\tar526b.tmp
- %WINDIR%\temp\cab525a.tmp
- %WINDIR%\temp\tar3d24.tmp
- %WINDIR%\temp\cab3d23.tmp
- %WINDIR%\temp\tar3cb5.tmp
- %WINDIR%\temp\cab3cb4.tmp
- %WINDIR%\temp\tar278e.tmp
- %WINDIR%\temp\cab278d.tmp
- %WINDIR%\temp\tar274d.tmp
- %WINDIR%\temp\cab273d.tmp
- %WINDIR%\temp\tar1207.tmp
- %WINDIR%\temp\cab1206.tmp
- %WINDIR%\temp\tar11e6.tmp
- %WINDIR%\temp\cab11e5.tmp
- %WINDIR%\temp\tar11a5.tmp
- %WINDIR%\temp\cab1195.tmp
- %WINDIR%\temp\tar1146.tmp
- %WINDIR%\temp\cab1145.tmp
- %WINDIR%\temp\tarfbff.tmp
- %WINDIR%\temp\cabfbfe.tmp
- %WINDIR%\temp\tarfba0.tmp
- %WINDIR%\temp\cabfb9f.tmp
- %WINDIR%\temp\tare58e.tmp
- %WINDIR%\temp\caba984.tmp
- %WINDIR%\temp\tara985.tmp
Network activity
Connects to
- 'localhost':49182
- 'localhost':49184
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49182
- 'localhost':49184
- 'localhost':49185
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\iqggkrnj2aedte3o.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "%WINDIR%\IQGgkRNJ2aEdTe3O.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "%WINDIR%\IQGgkRNJ2aEdTe3O.exe" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5
