Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\SysWOW64\WindowsHelper32.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\win player
Malicious functions
Patches code
in AMSI dll
- windowshelper32.exe process, Amsi.dll module
Modifies file system
Creates the following files
- %WINDIR%\syswow64\windowshelper32.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %WINDIR%\media\win player.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\win player.exe.log
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\windowshelper32.exe
- %WINDIR%\media\win player.exe
Network activity
Connects to
- 'dw######fjs0ds5.hopto.org':8848
- 'dv######ds8ds8.hopto.org':8848
- 'dv#####ds8ds5.hopto.org':8848
- 'cc######isnxss.hopto.org':8848
TCP
Other
- 'cc#####sdsmcs.hopto.org':8848
UDP
- DNS ASK gv######sds8ds5.hopto.org
- DNS ASK dw######fjs0ds5.hopto.org
- DNS ASK dv######ds8ds8.hopto.org
- DNS ASK dv#####ds8ds5.hopto.org
- DNS ASK dw######jfk8ds5.hopto.org
- DNS ASK cc#####sdsmcs.hopto.org
- DNS ASK cc######isnxss.hopto.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowshelper32.exe'
- '%WINDIR%\media\win player.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc minute /mo 1 /tn "Win Player" /tr "%WINDIR%\Media\Win Player.exe" & exit
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc minute /mo 1 /tn "Win Player" /tr "%WINDIR%\Media\Win Player.exe"
