Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowspowershell.wbemscripting.windowsdata
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Cndom6] 'ImagePath' = 'C:\Users\Public\Documents\x86-Microsoft-Windowsdata\Cndom6.sys'
Creates the following services
- 'Cndom6' C:\Users\Public\Documents\x86-Microsoft-Windowsdata\Cndom6.sys
Modifies file system
Creates the following files
- %TEMP%\is-sar85.tmp\<File name>.tmp
- %TEMP%\is-rsq79.tmp\_isetup\_setup64.tmp
- C:\users\public\documents\is-e5ani.tmp
- C:\users\public\documents\is-407u9.tmp
- C:\users\public\documents\men.exe
- C:\users\public\documents\x86-microsoft-windowsdata\tree.exe
- C:\users\public\documents\x86-microsoft-windowsdata\shell.log
- C:\users\public\documents\x86-microsoft-windowsdata\360.log
- C:\users\public\documents\x86-microsoft-windowsdata\wudfcompanionhoste.exe
- C:\users\public\documents\x86-microsoft-windowsdata\log.dll
- C:\users\public\documents\x86-microsoft-windowsdata\startmenuexperiencehostker.exe
- C:\users\public\documents\x86-microsoft-windowsdata\cndom6.sys
- %ALLUSERSPROFILE%\displaysessioncontainers.log
- nul
Deletes following files that it created itself
- C:\users\public\documents\men.b
- %TEMP%\is-rsq79.tmp\_isetup\_setup64.tmp
- %TEMP%\is-sar85.tmp\<File name>.tmp
- C:\users\public\documents\x86-microsoft-windowsdata\360.log
- C:\users\public\documents\x86-microsoft-windowsdata\shell.log
- C:\users\public\documents\x86-microsoft-windowsdata\tree.exe
Moves the following files
- from C:\users\public\documents\is-e5ani.tmp to C:\users\public\documents\men.b
- from C:\users\public\documents\is-407u9.tmp to C:\users\public\documents\server.log
- from C:\users\public\documents\server.log to C:\users\public\documents\x86-microsoft-windowsdata\server.log
Network activity
Connects to
- 'xu###cai.com':5050
TCP
Other
- 'xu###cai.com':5050
UDP
- DNS ASK xu###cai.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-sar85.tmp\<File name>.tmp' /SL5="$B01FC,3529773,845824,<Full path to file>"
- 'C:\users\public\documents\men.exe'
- 'C:\users\public\documents\x86-microsoft-windowsdata\startmenuexperiencehostker.exe'
- 'C:\users\public\documents\x86-microsoft-windowsdata\wudfcompanionhoste.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Enable-NetAdapter -Name 'Ethernet2' -Confirm:$false; Enable-NetAdapter -Name 'Ethernet1' -Confirm:$false; Enable-NetAdapter -Name 'Ethernet0' -Confirm:$false; Enable-NetAdapter -Name ...
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name=all verbose
- '<SYSTEM32>\netsh.exe' advfirewall firewall show rule name=all verbose
- '<SYSTEM32>\cmd.exe' /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\W...
- '<SYSTEM32>\cmd.exe' /c "ping -n 1 127.0.0.1 >nul & del /f /q ""C:\Users\Public\Documents\men.exe"" & del /f /q ""%0"""
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\takeown.exe' /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a
- '<SYSTEM32>\icacls.exe' "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F
- '<SYSTEM32>\takeown.exe' /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /grant Administrators:F
- '<SYSTEM32>\icacls.exe' "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.WindowsData" /deny Everyone:D
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData'; $acl = (Get-Item -Path $regPath).GetAccessC...
- 'C:\users\public\documents\men.exe' ' (with hidden window)
- 'C:\users\public\documents\x86-microsoft-windowsdata\startmenuexperiencehostker.exe' ' (with hidden window)
- 'C:\users\public\documents\x86-microsoft-windowsdata\wudfcompanionhoste.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name=all verbose' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.WindowsData" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\W...' (with hidden window)
