Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\hvhqjslvsfgpfarvnkqwirto
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\MjxoCpVOtHVSbkLHuMulMCuc] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\MjxoCpVOtHVSbkLHuMulMCuc] 'ImagePath' = 'cmd /c cd /d "C:\Drivers\HeatSenate" && start "" "C:\Drivers\HeatSenate\Provinceslearned1014.exe"'
Creates the following services
- 'MjxoCpVOtHVSbkLHuMulMCuc' cmd /c cd /d "C:\Drivers\HeatSenate" && start "" "C:\Drivers\HeatSenate\Provinceslearned1014.exe"
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM Provinceslearned1014.exe /T
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\is-rfi5g.tmp\<File name>.tmp
- %TEMP%\is-v2hdl.tmp\_isetup\_setup64.tmp
- %TEMP%\is-v2hdl.tmp\_isetup\_shfoldr.dll
- C:\drivers\heatsenate\is-9lcpf.tmp
- C:\drivers\heatsenate\is-njohn.tmp
- C:\drivers\heavydrops5712\is-eh9t9.tmp
- C:\drivers\fearsimmering12\is-3rpi9.tmp
- %HOMEPATH%\desktop\tsetup-x64.6.9.3.exe.lnk
- C:\drivers\drivers.dat.0
- C:\drivers\drivers.dat
- %TEMP%\is-tn1pd.tmp\installer.tmp
- \device\namedpipe\ntsvcs
- C:\users\public\pictures\runtime\rclttp
- C:\users\public\pictures\runtime\cookie\cookie.dat-journal
- C:\users\public\pictures\runtime\cookie\cookie.dat
- C:\users\public\pictures\runtime\cookie\cookie.dat-wal
- C:\users\public\pictures\runtime\lgi.dat
- nul
Sets the 'hidden' attribute to the following files
- C:\drivers\fearsimmering12\matthewscroll-7230.0xjo
- C:\drivers\heatsenate\provinceslearned1014.exe
- C:\drivers\heatsenate\snowsuitpixels5443.gfl1d
- C:\drivers\heavydrops5712\installer.exe
- C:\drivers\drivers.dat
- C:\drivers\drivers.dat.0
Deletes following files that it created itself
- %TEMP%\is-v2hdl.tmp\_isetup\_setup64.tmp
- %TEMP%\is-v2hdl.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-rfi5g.tmp\<File name>.tmp
- C:\users\public\pictures\runtime\cookie\cookie.dat-journal
Moves the following files
- from C:\drivers\heatsenate\is-9lcpf.tmp to C:\drivers\heatsenate\provinceslearned1014.exe
- from C:\drivers\heatsenate\is-njohn.tmp to C:\drivers\heatsenate\snowsuitpixels5443.gfl1d
- from C:\drivers\heavydrops5712\is-eh9t9.tmp to C:\drivers\heavydrops5712\installer.exe
- from C:\drivers\fearsimmering12\is-3rpi9.tmp to C:\drivers\fearsimmering12\matthewscroll-7230.0xjo
Network activity
Connects to
- '22#.6.6.6':443
- '9.#.9.9':443
- '<DNS_SERVER>':443
- '1.#.1.1':443
- 'ss#.com':80
- '22#.5.5.5':443
- '1.#.0.1':443
- 'localhost':7897
- 'localhost':7890
- 'localhost':10809
- 'localhost':10808
- 'localhost':20170
- '64.##3.162.94':80
- '65.##.210.175':443
- 'x1.#.lencr.org':80
- '64.##3.161.94':80
TCP
HTTP GET requests
- http://www.ss#.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- http://co#######itycheck.gstatic.com/generate_204
- http://x1.#.lencr.org/
Other
- '1.#.1.1':443
- '<DNS_SERVER>':443
- '9.#.9.9':443
- '22#.6.6.6':443
- '22#.5.5.5':443
- '1.#.0.1':443
- '65.##.210.175':443
UDP
- DNS ASK ss#.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-rfi5g.tmp\<File name>.tmp' /SL5="$E02C8,67989338,119296,<Full path to file>"
- 'C:\drivers\heatsenate\provinceslearned1014.exe'
- 'C:\drivers\heavydrops5712\installer.exe'
- '%TEMP%\is-tn1pd.tmp\installer.tmp' /SL5="$E01B4,51997062,864256,C:\Drivers\Heavydrops5712\installer.exe"
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\cmd.exe' /c waitfor.exe ZqIdleHeartbeat3f
- '<SYSTEM32>\waitfor.exe' ZqIdleHeartbeat3f
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"
- '<SYSTEM32>\cmd.exe' ver
- '<SYSTEM32>\icacls.exe' \"C:\Drivers\" /deny Users:(D)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
- '<SYSTEM32>\icacls.exe' \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
- '<SYSTEM32>\attrib.exe' C:\Drivers +s +h
- '<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D
- '<SYSTEM32>\schtasks.exe' /create /tn HvHQjSLVsFgPFaRvNKqwiRTO /tr "cmd /c cd /d \"C:\Drivers\HeatSenate\" && start \"\" \"C:\Drivers\HeatSenate\Provinceslearned1014.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /resync
- '<SYSTEM32>\cmd.exe' /K "chcp 65001 >nul"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\whoami.exe'
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Drivers\HeatSenate" && start "" "C:\Drivers\HeatSenate\Provinceslearned1014.exe"
- '<SYSTEM32>\schtasks.exe' /query /tn HvHQjSLVsFgPFaRvNKqwiRTO
- '%WINDIR%\syswow64\taskkill.exe' /F /IM Provinceslearned1014.exe /T' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c waitfor.exe ZqIdleHeartbeat3f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"' (with hidden window)
- '<SYSTEM32>\cmd.exe' ver' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"' (with hidden window)
- '<SYSTEM32>\attrib.exe' C:\Drivers +s +h' (with hidden window)
- '<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn HvHQjSLVsFgPFaRvNKqwiRTO /tr "cmd /c cd /d \"C:\Drivers\HeatSenate\" && start \"\" \"C:\Drivers\HeatSenate\Provinceslearned1014.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f' (with hidden window)
- '<SYSTEM32>\w32tm.exe' /resync' (with hidden window)
- '<SYSTEM32>\cmd.exe' /K "chcp 65001 >nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Drivers\HeatSenate" && start "" "C:\Drivers\HeatSenate\Provinceslearned1014.exe"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /query /tn HvHQjSLVsFgPFaRvNKqwiRTO' (with hidden window)
