Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\subscription\microsoft compatibility system
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
Modifies file system
Creates the following files
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\ie\setup[1].exe
- %CommonProgramFiles%\nvgpu_x64.exe
- %CommonProgramFiles%\nvml.dll
- %CommonProgramFiles%\nvml.bin
Deletes following files that it created itself
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\ie\setup[1].exe
Moves itself
- from <Full path to file> to %TEMP%\tmp2d89.tmp
Network activity
Connects to
- '19#.#53.225.173':80
TCP
HTTP GET requests
- http://19#.#53.225.173/getinstall64
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<Full path to file>' ' (with hidden window)
- '<SYSTEM32>\svchost.exe' -k netsvcs' (with hidden window)
