Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Rsemgw qeigyoqw] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Rsemgw qeigyoqw] 'ImagePath' = 'C:\Users\Default\AppData\Local\Microsoft\Office\zgjNrdc\Ucwaig.exe -svc'
Creates the following services
- 'Rsemgw qeigyoqw' C:\Users\Default\AppData\Local\Microsoft\Office\zgjNrdc\Ucwaig.exe -svc
Malicious functions
Creates and executes the following
- '<SYSTEM32>\cmd.exe' (downloaded from the Internet)
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
- %WINDIR%\syswow64\dllhost.exe
Modifies file system
Creates the following files
- C:\users\public\dwin
- %HOMEPATH%\downloads\z6100.exe
- %HOMEPATH%\downloads\unityplayer.dll
- %HOMEPATH%\downloads\unityplayer.dat
- %HOMEPATH%\downloads\zldel_6100.bat
- nul
- C:\users\default\appdata\local\microsoft\office\zgjnrdc\ucwaig.exe
- C:\users\default\appdata\local\microsoft\office\zgjnrdc\unityplayer.dll
- C:\users\default\appdata\local\microsoft\office\zgjnrdc\unityplayer.dat
Sets the 'hidden' attribute to the following files
- C:\users\default\appdata\local\microsoft\office\zgjnrdc\ucwaig.exe
- C:\users\default\appdata\local\microsoft\office\zgjnrdc\unityplayer.dll
- C:\users\default\appdata\local\microsoft\office\zgjnrdc\unityplayer.dat
Moves the following files
- from %HOMEPATH%\downloads\z6100.exe to %WINDIR%\temp\880921.bak
- from %HOMEPATH%\downloads\unityplayer.dat to %WINDIR%\temp\880953.bak
- from %HOMEPATH%\downloads\unityplayer.dll to %WINDIR%\temp\880984.bak
Network activity
Connects to
- '10#.#4.205.86':16698
- '23.##2.132.67':8808
TCP
HTTP GET requests
- http://10#.##.205.86:16698/r8002/UnityPlayer.dat?t=################# via 10#.#4.205.86
Other
- '15#.#01.65.91':443
- '23.##2.132.67':8808
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\downloads\z6100.exe'
- 'C:\users\default\appdata\local\microsoft\office\zgjnrdc\ucwaig.exe' -svc
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%HOMEPATH%\Downloads\zldel_6100.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs
- '%WINDIR%\syswow64\dllhost.exe' -ks
- '<SYSTEM32>\cmd.exe' /C "%HOMEPATH%\Downloads\zldel_6100.bat"' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs' (with hidden window)
- '%WINDIR%\syswow64\dllhost.exe' -ks' (with hidden window)
