Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AVSvc' = '%APPDATA%\Roaming\ithoqwy.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AVSvc' = '%APPDATA%\Roaming\ithoqwy.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Roaming\ithoqwy.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /Quiet
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
the following user processes:
- ecmd.exe
Modifies file system :
Creates the following files:
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vcredist.exe_d9a1e9f8957f63aeacd7527a3c66aa52491cfb82_cab_097b4098\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_vc6redistsetup_e_81f683eaf25a5eb65b84b6ead9f13c45a48e7d43_cab_097aefca\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_05d6c428\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_f798d2f057d38094f597ee5b2ac850417ab4a15d_cab_06ed1b9a\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30b340eb8e02812f59aa5726f432f9eb8f4453d_cab_04570da6\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Templates\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.6.7600.256_fa9f59c145989d6f0b41711f5b2db0e982417_cab_06aa7c03\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportArchive\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\ReportQueue\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\LocalCopy\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Quarantine\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\ResourceData\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Entries\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\WER\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{530E0921-A5E7-41DC-809D-0892C07A16A6}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Sessions\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\Upload\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Sqm\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Far Manager 3\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QIP 2012\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Sun\Java\Java Update\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Package Cache\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\WwanSvc\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Oracle\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Sun\Java\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\Temp\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Roaming\Media Center Programs\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Sun\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\History\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\HELP_TO_SAVE_FILES.txt
- C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Support\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\CleanStore\Resources\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSScan\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Inbox\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\SentItems\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\RSA\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\Client\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\Keys\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Crypto\DSS\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\DeviceSync\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\DRM\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\DRM\Server\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Device\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\HELP_TO_SAVE_FILES.txt
- <Current directory>\HELP_TO_SAVE_FILES.txt
- C:\$Recycle.Bin\HELP_TO_SAVE_FILES.txt
- C:\Users\HELP_TO_SAVE_FILES.txt
- C:\PerfLogs\HELP_TO_SAVE_FILES.txt
- C:\PerfLogs\Admin\HELP_TO_SAVE_FILES.txt
- %APPDATA%\Roaming\key.dat
- %APPDATA%\Roaming\ithoqwy.exe
- %HOMEPATH%\Documents\RECOVERY_FILE.TXT
- C:\$Recycle.Bin\S-1-5-21-2832440558-3064306045-1455513625-1000\HELP_TO_SAVE_FILES.txt
- %APPDATA%\Roaming\log.html
- C:\Recovery\1f81b231-1de2-11e4-b170-f6484b474a13\HELP_TO_SAVE_FILES.txt
- C:\Users\Public\Documents\HELP_TO_SAVE_FILES.txt
- C:\Users\Public\Desktop\HELP_TO_SAVE_FILES.txt
- C:\Users\Public\Favorites\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\Client\1.0\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\HELP_TO_SAVE_FILES.txt
- <Auxiliary element>
- C:\Recovery\HELP_TO_SAVE_FILES.txt
- C:\totalcmd\LANGUAGE\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\HELP_TO_SAVE_FILES.txt
- C:\totalcmd\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Temp\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\User Account Pictures\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DRM\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DRM\Cache\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\GameExplorer\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Ringtones\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\AIT\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Vault\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\Caches\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\MF\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\NetFramework\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Network\Downloader\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Network\Connections\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\eHome\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\eHome\logs\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\IdentityCRL\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Media Player\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\IlsCache\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Network\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Config\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\RAC\PublishedData\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\RAC\Outbound\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\RAC\StateData\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\RAC\HELP_TO_SAVE_FILES.txt
- C:\ProgramData\Microsoft\RAC\Temp\HELP_TO_SAVE_FILES.txt
Deletes itself.
Network activity:
UDP:
- DNS ASK dp########7lelsa.aenf387awmx28.com
- DNS ASK dp########7lelsa.od9wjn4iene29.com
- DNS ASK ip##fo.io
- DNS ASK dn#.##ftncsi.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
