Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\TaskWorker] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\TaskWorker] 'ImagePath' = 'cmd /c cd /d "C:\Drivers\nZPf" && start "" "C:\Drivers\nZPf\lfrSQ9.exe"'
Creates the following services
- 'TaskWorker' cmd /c cd /d "C:\Drivers\nZPf" && start "" "C:\Drivers\nZPf\lfrSQ9.exe"
Malicious functions
Launches a large number of processes
Patches code
in dll
- lfrsq9.exe process, AEPIC.dll module
- lfrsq9.exe process, apphelp.dll module
in AMSI dll
- lfrsq9.exe process, Amsi.dll module
in NTDLL dll
- lfrsq9.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\is-qc3km.tmp\<File name>.tmp
- %TEMP%\is-6i1ba.tmp\_isetup\_setup64.tmp
- C:\drivers\nzpf\is-8vdi6.tmp
- C:\drivers\nzpf\is-j923r.tmp
- C:\drivers\nzpf\is-oi68d.tmp
- C:\drivers\nzpf\is-pglsd.tmp
- C:\drivers\nzpf\is-b2iin.tmp
- C:\drivers\nzpf\is-7litf.tmp
- C:\drivers\nzpf\is-engrf.tmp
- C:\drivers\nzpf\is-ivrqn.tmp
- C:\drivers\haz\is-vk558.tmp
- C:\drivers\xzqpi4\is-o4o15.tmp
- %HOMEPATH%\desktop\kuailianpc-64.lnk
Deletes following files that it created itself
- %TEMP%\is-6i1ba.tmp\_isetup\_setup64.tmp
- %TEMP%\is-qc3km.tmp\<File name>.tmp
Moves the following files
- from C:\drivers\nzpf\is-8vdi6.tmp to C:\drivers\nzpf\9psem3vwtd9.guj
- from C:\drivers\nzpf\is-j923r.tmp to C:\drivers\nzpf\apcyszrsxq.hf
- from C:\drivers\nzpf\is-oi68d.tmp to C:\drivers\nzpf\lfrsq9.exe
- from C:\drivers\nzpf\is-pglsd.tmp to C:\drivers\nzpf\libfilezilla-58.dll
- from C:\drivers\nzpf\is-b2iin.tmp to C:\drivers\nzpf\libgcc_s_seh-1.dll
- from C:\drivers\nzpf\is-7litf.tmp to C:\drivers\nzpf\libstdc++-6.dll
- from C:\drivers\nzpf\is-engrf.tmp to C:\drivers\nzpf\ne.qd
- from C:\drivers\nzpf\is-ivrqn.tmp to C:\drivers\nzpf\um30vz.kb
- from C:\drivers\haz\is-vk558.tmp to C:\drivers\haz\installer.exe
- from C:\drivers\xzqpi4\is-o4o15.tmp to C:\drivers\xzqpi4\123.png
Miscellaneous
Creates and executes the following
- '%TEMP%\is-qc3km.tmp\<File name>.tmp' /SL5="$E01D8,30869391,832512,<Full path to file>"
- 'C:\drivers\nzpf\lfrsq9.exe'
Executes the following
- '<SYSTEM32>\sc.exe' create TaskWorker binPath= "cmd /c cd /d \"C:\Drivers\nZPf\" && start \"\" \"C:\Drivers\nZPf\lfrSQ9.exe\"" start= auto
- '<SYSTEM32>\sc.exe' failure TaskWorker reset= 0 actions= restart/1000
- '<SYSTEM32>\sc.exe' start TaskWorker
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Drivers\nZPf" && start "" "C:\Drivers\nZPf\lfrSQ9.exe"
- '<SYSTEM32>\sc.exe' start VSS
- '<SYSTEM32>\sc.exe' create TaskWorker binPath= "cmd /c cd /d \"C:\Drivers\nZPf\" && start \"\" \"C:\Drivers\nZPf\lfrSQ9.exe\"" start= auto' (with hidden window)
- '<SYSTEM32>\sc.exe' failure TaskWorker reset= 0 actions= restart/1000' (with hidden window)
- '<SYSTEM32>\sc.exe' start TaskWorker' (with hidden window)
- '<SYSTEM32>\sc.exe' start VSS' (with hidden window)
