Technical Information
Modifies file system
Creates the following files
- %WINDIR%\s14p1rkfnp598aq4.exe
- %WINDIR%\temp\tara658.tmp
- %WINDIR%\temp\caba657.tmp
- %WINDIR%\temp\tar9140.tmp
- %WINDIR%\temp\cab913f.tmp
- %WINDIR%\temp\tar910f.tmp
- %WINDIR%\temp\cab90ff.tmp
- %WINDIR%\temp\tar7bc9.tmp
- %WINDIR%\temp\cab7bc8.tmp
- %WINDIR%\temp\tar7b79.tmp
- %WINDIR%\temp\cab7b78.tmp
- %WINDIR%\temp\tar6642.tmp
- %WINDIR%\temp\cab6641.tmp
- %WINDIR%\temp\tar65f2.tmp
- %WINDIR%\temp\cab65f1.tmp
- %WINDIR%\temp\cabe7ac.tmp
- %WINDIR%\temp\tar508d.tmp
- %WINDIR%\temp\tar505c.tmp
- %WINDIR%\temp\cab505b.tmp
- %WINDIR%\temp\tar501b.tmp
- %WINDIR%\temp\cab501a.tmp
- %WINDIR%\temp\tar4fcb.tmp
- %WINDIR%\temp\cab4fca.tmp
- %WINDIR%\temp\tar3a95.tmp
- %WINDIR%\temp\cab3a94.tmp
- %WINDIR%\temp\tar3a54.tmp
- %WINDIR%\temp\cab3a53.tmp
- %WINDIR%\temp\tar2453.tmp
- %WINDIR%\temp\cab2452.tmp
- %WINDIR%\vmprotectsdk64.dll
- %WINDIR%\wvconaytc6f7hcgo.exe
- %WINDIR%\temp\cab508c.tmp
- %WINDIR%\temp\tare7ad.tmp
Sets the 'hidden' attribute to the following files
- %WINDIR%\s14p1rkfnp598aq4.exe
- %WINDIR%\wvconaytc6f7hcgo.exe
- %WINDIR%\vmprotectsdk64.dll
Deletes the following files
- %WINDIR%\temp\cab2452.tmp
- %WINDIR%\temp\tara658.tmp
- %WINDIR%\temp\caba657.tmp
- %WINDIR%\temp\tar9140.tmp
- %WINDIR%\temp\cab913f.tmp
- %WINDIR%\temp\tar910f.tmp
- %WINDIR%\temp\cab90ff.tmp
- %WINDIR%\temp\tar7bc9.tmp
- %WINDIR%\temp\cab7bc8.tmp
- %WINDIR%\temp\tar7b79.tmp
- %WINDIR%\temp\cab7b78.tmp
- %WINDIR%\temp\tar6642.tmp
- %WINDIR%\temp\cab6641.tmp
- %WINDIR%\temp\tar65f2.tmp
- %WINDIR%\temp\cab65f1.tmp
- %WINDIR%\temp\tar508d.tmp
- %WINDIR%\temp\cab508c.tmp
- %WINDIR%\temp\tar505c.tmp
- %WINDIR%\temp\cab505b.tmp
- %WINDIR%\temp\tar501b.tmp
- %WINDIR%\temp\cab501a.tmp
- %WINDIR%\temp\tar4fcb.tmp
- %WINDIR%\temp\cab4fca.tmp
- %WINDIR%\temp\tar3a95.tmp
- %WINDIR%\temp\cab3a94.tmp
- %WINDIR%\temp\tar3a54.tmp
- %WINDIR%\temp\cab3a53.tmp
- %WINDIR%\temp\tar2453.tmp
- %WINDIR%\temp\cabe7ac.tmp
- %WINDIR%\temp\tare7ad.tmp
Network activity
Connects to
- 'localhost':49185
- 'localhost':49187
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49185
- 'localhost':49187
- 'localhost':49188
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\s14p1rkfnp598aq4.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "%WINDIR%\s14p1RKfNp598aq4.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "%WINDIR%\s14p1RKfNp598aq4.exe" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5
