Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Syshost' = '"%APPDATA%\syshost.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security checks
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\sihost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
the following user processes:
- msedge.exe
Patches code
in AMSI dll
- rxdwxxqg.exe process, Amsi.dll module
in NTDLL dll
- rxdwxxqg.exe process, ntdll.dll module
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %TEMP%\jn6xpg3z.exe
- %TEMP%\nx1tolmv.exe
- %TEMP%\i1daxs2z.exe
- %TEMP%\is-foh1w3ovh4.tmp\i1daxs2z.tmp
- %TEMP%\is-p8kifpx6k9.tmp\_isetup\_isdecmp.dll
- %TEMP%\9f17bf9b8ad74c3eaf7e.exe
- %TEMP%\d8697301ba2d483cbe95.exe
- %APPDATA%\syshost.exe
- %TEMP%\is-wlb5xnuley.tmp\9f17bf9b8ad74c3eaf7e.tmp
- %TEMP%\is-7nvcp41h7x.tmp\_isetup\_isdecmp.dll
- %TEMP%\ed5hn59h.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %APPDATA%\syshost.exe
Modifies the following files
Network activity
Connects to
- 'google.com':80
- 'bing.com':80
- '19#.#78.158.107':80
TCP
HTTP GET requests
- http://www.google.com/
- http://www.bing.com/
HTTP POST requests
- http://19#.#78.158.107/vbv/get.php?ui######################################################
- http://19#.#78.158.107/vbv/get.php?ui#################################################################################
- http://19#.#78.158.107/vbv/get.php?ui#######################################################
- http://19#.#78.158.107/vbv/get.php?ui##############################################################
- http://19#.#78.158.107/auth.php
UDP
- DNS ASK google.com
- DNS ASK bing.com
Miscellaneous
Creates and executes the following
- '%TEMP%\jn6xpg3z.exe'
- '%TEMP%\nx1tolmv.exe'
- '%TEMP%\i1daxs2z.exe'
- '%TEMP%\is-foh1w3ovh4.tmp\i1daxs2z.tmp' /SL5="$120278,3755066,888832,%TEMP%\i1daxs2z.exe"
- '%TEMP%\d8697301ba2d483cbe95.exe'
- '%APPDATA%\syshost.exe'
- '%TEMP%\9f17bf9b8ad74c3eaf7e.exe'
- '%TEMP%\is-wlb5xnuley.tmp\9f17bf9b8ad74c3eaf7e.tmp' /SL5="$70168,3755066,888832,%TEMP%\9F17BF9B8AD74C3EAF7E.exe"
- '%TEMP%\ed5hn59h.exe'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-sandbox
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"
- '<SYSTEM32>\netsh.exe' wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\"
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"' (with hidden window)
- '%TEMP%\d8697301ba2d483cbe95.exe' ' (with hidden window)
- '%APPDATA%\syshost.exe' ' (with hidden window)
- '%TEMP%\9f17bf9b8ad74c3eaf7e.exe' ' (with hidden window)
