Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Executes the following
- '%WINDIR%\syswow64\at.exe' 9:00 /interactive %WINDIR%\svhost.exe
Modifies file system
Creates the following files
- %WINDIR%\svhost.exe
- %WINDIR%\temp\~df57d99382a309e3ab.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\internet explorer\recovery\high\active\{196cd617-e73c-11e9-ae71-f034a709af15}.dat
- %WINDIR%\temp\~df986efa1492706dbb.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\internet explorer\recovery\high\active\recoverystore.{196cd616-e73c-11e9-ae71-f034a709af15}.dat
- %WINDIR%\syswow64\config\systemprofile\favorites\links\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
- D:\system volume information.exe
- D:\$recycle.bin.exe
- %WINDIR%.exe
- C:\users.exe
- C:\totalcmd.exe
- C:\system volume information.exe
- C:\recovery.exe
- <Current directory>.exe
- %PROGRAMDATA%.exe
- %ProgramFiles(x86)%.exe
- %ProgramFiles%.exe
- C:\perflogs.exe
- C:\msocache.exe
- C:\far2.exe
- C:\documents and settings.exe
- C:\$recycle.bin.exe
- C:\startup.exe
- %WINDIR%\syswow64\svhost.exe
- %WINDIR%\syswow64\system.exe
- %WINDIR%\driver.db
- %WINDIR%\syswow64\commander.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\privacie\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\internet explorer\msimgsiz.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\svhost.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\links\desktop.ini
Deletes the following files
- %WINDIR%\tasks\adobe flash player updater.job
- %WINDIR%\tasks\sa.dat
- <SYSTEM32>\tasks\adobe flash player updater
Network activity
UDP
- DNS ASK in#####e.freevnn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\commander.exe' /C at 9:00 /interactive %WINDIR%\svhost.exe
- '%WINDIR%\syswow64\system.exe' copy%ProgramFiles%.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%ProgramFiles(x86)%.exe
- '%WINDIR%\syswow64\system.exe' copy%ProgramFiles(x86)%.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%PROGRAMDATA%.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy<Current directory>.exe
- '%WINDIR%\syswow64\system.exe' copy<Current directory>.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Recovery.exe
- '%WINDIR%\syswow64\system.exe' copyc:\Recovery.exe
- '%WINDIR%\syswow64\system.exe' copyc:\Users.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Users.exe
- '%WINDIR%\syswow64\system.exe' copyc:\totalcmd.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%WINDIR%.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\System Volume Information.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%ProgramFiles%.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\totalcmd.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyd:\$RECYCLE.BIN.exe
- '%WINDIR%\syswow64\system.exe' copy%WINDIR%.exe
- '%WINDIR%\syswow64\system.exe' copy%PROGRAMDATA%.exe
- '%WINDIR%\syswow64\system.exe' copyd:\$RECYCLE.BIN.exe
- '%WINDIR%\syswow64\system.exe' copyc:\Documents and Settings.exe
- '%WINDIR%\syswow64\system.exe' copyc:\System Volume Information.exe
- '%WINDIR%\syswow64\system.exe' copyc:\PerfLogs.exe
- '%WINDIR%\syswow64\system.exe' copyd:\System Volume Information.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\PerfLogs.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Documents and Settings.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy\startup.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\$Recycle.Bin.exe
- '%WINDIR%\syswow64\system.exe' copyc:\$Recycle.Bin.exe
- '%WINDIR%\svhost.exe'
- '%WINDIR%\syswow64\system.exe' copy\startup.exe
- '%WINDIR%\syswow64\system.exe' copyc:\MSOCache.exe
- '%WINDIR%\syswow64\commander.exe' /C schtasks /run /tn at1
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyd:\System Volume Information.exe
- '%WINDIR%\syswow64\system.exe' copyc:\Far2.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Far2.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\MSOCache.exe
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\System Volume Information.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\totalcmd.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyd:\$RECYCLE.BIN.exe' (with hidden window)
- '%WINDIR%\svhost.exe' ' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C at 9:00 /interactive %WINDIR%\svhost.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Users.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy\startup.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C schtasks /run /tn at1' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%WINDIR%.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Recovery.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Documents and Settings.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy<Current directory>.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\Far2.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%PROGRAMDATA%.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyd:\System Volume Information.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\MSOCache.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%ProgramFiles%.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\$Recycle.Bin.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copyc:\PerfLogs.exe' (with hidden window)
- '%WINDIR%\syswow64\commander.exe' /C %WINDIR%\SysWOW64\system.exe copy%ProgramFiles(x86)%.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /run /tn at1
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -Embedding
- '%WINDIR%\syswow64\ie4uinit.exe' -ShowQLIcon
