Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\appxdeploymentclient\microsoft compatibility system
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
Modifies file system
Creates the following files
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\ie\setup[1].exe
- %CommonProgramFiles%\nvgpu_x64.exe
- %CommonProgramFiles%\nvml.dll
- %CommonProgramFiles%\nvml.bin
Deletes following files that it created itself
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\ie\setup[1].exe
Moves itself
- from <Full path to file> to %TEMP%\tmpd6e.tmp
Network activity
Connects to
- 'os##x.cn':80
TCP
HTTP GET requests
- http://os##x.cn/getinstall64
UDP
- DNS ASK os##x.cn
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<Full path to file>' ' (with hidden window)
- '<SYSTEM32>\svchost.exe' -k netsvcs' (with hidden window)
