Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\startmenuexperiencehost
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\startmenuexperiencehost.exe
Sets the 'hidden' attribute to the following files
- <Full path to file>
- %ALLUSERSPROFILE%\startmenuexperiencehost.exe
Network activity
Connects to
- '14#.#2.43.221':6666
- 'zh####s.ipshu.com':443
- 'oc##.##ust-provider.cn':80
TCP
HTTP GET requests
- http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQC2B52AzlDX1r7UsJRUZ6J5
Other
- '14#.#2.43.221':6666
- 'zh####s.ipshu.com':443
UDP
- DNS ASK zh####s.ipshu.com
- DNS ASK oc##.##ust-provider.cn
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\startmenuexperiencehost.exe'
