Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\wmiApSrv] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\f77zXbU5] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\f77zXbU5] 'ImagePath' = 'cmd /c cd /d "%ProgramFiles(x86)%\doont\jtymmamm\" && start "" "%ProgramFiles(x86)%\doont\jtymmamm\f77zXbU5.exe"'
Creates the following services
- 'f77zXbU5' cmd /c cd /d "%ProgramFiles(x86)%\doont\jtymmamm\" && start "" "%ProgramFiles(x86)%\doont\jtymmamm\f77zXbU5.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\' -Force
Modifies file system
Creates the following files
- %TEMP%\is-blird.tmp\<File name>.tmp
- %TEMP%\is-4f6hr.tmp\_isetup\_regdll.tmp
- %TEMP%\is-4f6hr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4f6hr.tmp\_isetup\_shfoldr.dll
- C:\users\public\<File name>.exe
- %ProgramFiles(x86)%\doont\jtymmamm\is-b4f8u.tmp
- %ProgramFiles(x86)%\doont\jtymmamm\is-qoh3l.tmp
- %ProgramFiles(x86)%\doont\jtymmamm\is-1shdg.tmp
- %ProgramFiles(x86)%\doont\jtymmamm\ncrxqoz
- <SYSTEM32>\nwsxsyu
- %WINDIR%\tmbfpvoj.bat
- <SYSTEM32>\tunxsyo
- nul
- %WINDIR%\temp\__psscriptpolicytest_sldzue3u.ad4.ps1
- %WINDIR%\temp\__psscriptpolicytest_j4ezwttt.xfu.psm1
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-48-342.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-48-704.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-48-945.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-49-354.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-49-552.dump
- %WINDIR%\temp\__psscriptpolicytest_5xeb1q5d.avm.ps1
- %WINDIR%\temp\__psscriptpolicytest_degin3ih.ajz.psm1
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-50-586.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-50-698.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-50-815.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-51-016.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-51-636.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-52-309.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-52-674.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-52-763.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-52-831.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-52-909.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-52-987.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-53-090.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-53-156.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-174.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-376.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-513.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-532.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-660.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-714.dump
- %WINDIR%\temp\content\2080-3224-powershell.exe-14-07-55-847.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
Deletes following files that it created itself
- %TEMP%\is-4f6hr.tmp\_isetup\_regdll.tmp
- %TEMP%\is-4f6hr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4f6hr.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-blird.tmp\<File name>.tmp
- %WINDIR%\temp\__psscriptpolicytest_sldzue3u.ad4.ps1
- %WINDIR%\temp\__psscriptpolicytest_j4ezwttt.xfu.psm1
- %WINDIR%\temp\__psscriptpolicytest_5xeb1q5d.avm.ps1
- %WINDIR%\temp\__psscriptpolicytest_degin3ih.ajz.psm1
Moves the following files
- from %ProgramFiles(x86)%\doont\jtymmamm\is-b4f8u.tmp to %ProgramFiles(x86)%\doont\jtymmamm\ne0qukw7.a
- from %ProgramFiles(x86)%\doont\jtymmamm\is-qoh3l.tmp to %ProgramFiles(x86)%\doont\jtymmamm\smdw.u
- from %ProgramFiles(x86)%\doont\jtymmamm\is-1shdg.tmp to %ProgramFiles(x86)%\doont\jtymmamm\f77zxbu5.exe
Network activity
Connects to
- '27.#24.17.3':7539
TCP
Other
- '27.#24.17.3':7539
Miscellaneous
Searches for the following windows
- ClassName: 'Q360SafeMonClass' WindowName: ''
Creates and executes the following
- '%TEMP%\is-blird.tmp\<File name>.tmp' /SL5="$B01C0,7351885,158208,<Full path to file>"
- '%ProgramFiles(x86)%\doont\jtymmamm\f77zxbu5.exe'
Executes the following
- '<SYSTEM32>\wbem\wmiapsrv.exe'
- '<SYSTEM32>\cmd.exe' /c "%WINDIR%\tmBFpvoj.bat"
- '<SYSTEM32>\systemsettingsbroker.exe'
- '<SYSTEM32>\tasklist.exe' /fi "PID eq 5300"
- '<SYSTEM32>\findstr.exe' /i "5300"
- '<SYSTEM32>\timeout.exe' /t 15
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\' -Force' (with hidden window)
