Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\startup_1exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %LOCALAPPDATA%\yourapp\资料.txt
- %LOCALAPPDATA%\yourapp\qbcore.dll
- %LOCALAPPDATA%\yourapp\wechatweb.exe
- %LOCALAPPDATA%\yourapp\空白.pptx
- C:\users\public\上线信息.ini
- %ALLUSERSPROFILE%\displaysessioncontainers.log
- %LOCALAPPDATA%\yourapp\~$空白.pptx
Network activity
Connects to
- '13#.#22.204.241':447
TCP
Other
- '13#.#22.204.241':447
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\yourapp\wechatweb.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "Startup_1exe"
- '%ProgramFiles(x86)%\microsoft office\office16\powerpnt.exe' "%LOCALAPPDATA%\YourApp\空白.pptx" /ou ""
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "Startup_1exe"' (with hidden window)
