Technical Information
Modifies file system
Creates the following files
- %WINDIR%\ucyequ3nologc1fa.bat
- %WINDIR%\temp\cab40f4.tmp
- %WINDIR%\temp\tar40f5.tmp
- %WINDIR%\temp\cab4115.tmp
- %WINDIR%\temp\tar4116.tmp
- %WINDIR%\temp\cab560e.tmp
- %WINDIR%\temp\tar560f.tmp
- %WINDIR%\temp\tar563f.tmp
- %WINDIR%\temp\cabc3f7.tmp
- %WINDIR%\temp\cab6b37.tmp
- %WINDIR%\temp\tar6b38.tmp
- %WINDIR%\temp\cab6b68.tmp
- %WINDIR%\temp\tar6b69.tmp
- %WINDIR%\temp\cab8060.tmp
- %WINDIR%\temp\tar8061.tmp
- %WINDIR%\temp\tar2c0c.tmp
- %WINDIR%\temp\cab563e.tmp
- %WINDIR%\temp\cab2c0b.tmp
- %WINDIR%\temp\cab1640.tmp
- %WINDIR%\0mvwxgrizg4ew5mna.exe
- %WINDIR%\mzgrfo5mopefwaum.exe
- %WINDIR%\ucrtbased.dll
- %WINDIR%\s5yar3fixazbajwr.sys
- %WINDIR%\temp\cab10.tmp
- %WINDIR%\temp\tar11.tmp
- %WINDIR%\temp\tar1641.tmp
- %WINDIR%\temp\cab2bda.tmp
- %WINDIR%\temp\cab1690.tmp
- %WINDIR%\temp\tar1691.tmp
- %WINDIR%\temp\cab2b79.tmp
- %WINDIR%\temp\tar2b7a.tmp
- %WINDIR%\temp\cab2bb9.tmp
- %WINDIR%\temp\tar2bba.tmp
- %WINDIR%\temp\tar2bdb.tmp
- %WINDIR%\temp\tarc3f8.tmp
Sets the 'hidden' attribute to the following files
- %WINDIR%\ucyequ3nologc1fa.bat
- %WINDIR%\0mvwxgrizg4ew5mna.exe
- %WINDIR%\mzgrfo5mopefwaum.exe
- %WINDIR%\ucrtbased.dll
- %WINDIR%\s5yar3fixazbajwr.sys
Deletes the following files
- %WINDIR%\temp\cab10.tmp
- %WINDIR%\temp\tar8061.tmp
- %WINDIR%\temp\cab8060.tmp
- %WINDIR%\temp\tar6b69.tmp
- %WINDIR%\temp\cab6b68.tmp
- %WINDIR%\temp\tar6b38.tmp
- %WINDIR%\temp\cab6b37.tmp
- %WINDIR%\temp\tar563f.tmp
- %WINDIR%\temp\cab563e.tmp
- %WINDIR%\temp\tar560f.tmp
- %WINDIR%\temp\cab560e.tmp
- %WINDIR%\temp\tar4116.tmp
- %WINDIR%\temp\cab4115.tmp
- %WINDIR%\temp\tar40f5.tmp
- %WINDIR%\temp\cab40f4.tmp
- %WINDIR%\temp\tar2c0c.tmp
- %WINDIR%\temp\cab2c0b.tmp
- %WINDIR%\temp\tar2bdb.tmp
- %WINDIR%\temp\cab2bda.tmp
- %WINDIR%\temp\tar2bba.tmp
- %WINDIR%\temp\cab2bb9.tmp
- %WINDIR%\temp\tar2b7a.tmp
- %WINDIR%\temp\cab2b79.tmp
- %WINDIR%\temp\tar1691.tmp
- %WINDIR%\temp\cab1690.tmp
- %WINDIR%\temp\tar1641.tmp
- %WINDIR%\temp\cab1640.tmp
- %WINDIR%\temp\tar11.tmp
- %WINDIR%\temp\cabc3f7.tmp
- %WINDIR%\temp\tarc3f8.tmp
Moves the following files
- from %WINDIR%\mzgrfo5mopefwaum.exe to %WINDIR%\m2er4hr88whvithf.exe
Network activity
Connects to
- 'localhost':49190
- 'localhost':49192
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49190
- 'localhost':49192
- 'localhost':49193
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\mzgrfo5mopefwaum.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "%WINDIR%\MZgrfO5mOPEFWauM.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "%WINDIR%\MZgrfO5mOPEFWauM.exe" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5
