Technical Information
Malicious functions
Patches code
in AMSI dll
- txyu.exe process, Amsi.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\mshta.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\delivery optimization\9ec468219d62736d\txyu.exe
- %ALLUSERSPROFILE%\delivery optimization\9ec468219d62736d\launch.hta
- %TEMP%\tmp3000.tmp
- %TEMP%\tmp34b4.tmp
- %APPDATA%\microsoft\crypto\keys\8daa70ea5e60f97ed4d7c333ae560691_8cf7b530-613e-439b-a8c5-ccfc0e745400
Deletes following files that it created itself
- %TEMP%\tmp3000.tmp
- %TEMP%\tmp34b4.tmp
Network activity
Connects to
- 'msdl.microsoft.com':443
- 'oneocsp.microsoft.com':80
- 'localhost':56001
- 'localhost':56002
- 'localhost':56003
- '45.##2.214.54':56001
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?48##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D
Other
- 'msdl.microsoft.com':443
- '45.##2.214.54':56001
UDP
- DNS ASK msdl.microsoft.com
- DNS ASK oneocsp.microsoft.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\delivery optimization\9ec468219d62736d\txyu.exe'
Executes the following
- '<SYSTEM32>\mshta.exe' "%ALLUSERSPROFILE%\Delivery Optimization\9ec468219d62736d\launch.hta"
