Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop spooler
Network activity
Connects to
- '10.##.81.121':445
- '10.##.81.121':139
Miscellaneous
Searches for the following windows
- ClassName: 'BUTTON' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" /v StatusUpdateInterval /t REG_DWORD /d 10 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v HWAddress /f
- '%WINDIR%\syswow64\net1.exe' start spooler
- '%WINDIR%\syswow64\net.exe' start spooler
- '%WINDIR%\syswow64\net1.exe' stop spooler
- '%WINDIR%\syswow64\cmd.exe' /C net stop spooler & net start spooler
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Index" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v PortNumber /t REG_DWORD /d 9100 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Enabled" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Community" /t REG_SZ /d public /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Community" /t REG_SZ /d public /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v PortNumber /t REG_DWORD /d 9100 /f
- '%WINDIR%\syswow64\cmd.exe' /C rundll32 printui.dll,PrintUIEntry /if /b "Canon iR2420 UFRII LT(7楼保安室打印机)" /f \\10.##.81.121\data\Customer_DEPT\打印驱动-勿删\UFRII_Driver_v2070_W32_ZH\Driver\CNLB0C.INF /r "IP_10.79.67.220" /m "C...
- '<SYSTEM32>\spoolsv.exe'
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Enabled" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Index" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" /v StatusUpdateEnabled /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v HostName /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v HostName /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v Version /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v Version /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v Protocol /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\rundll32.exe' printui.dll,PrintUIEntry /if /b "Canon iR2420 UFRII LT(7楼保安室打印机)" /f \\10.##.81.121\data\Customer_DEPT\打印驱动-勿删\UFRII_Driver_v2070_W32_ZH\Driver\CNLB0C.INF /r "IP_10.79.67.220" /m "Canon iR2420 ...
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" /v StatusUpdateEnabled /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" /v StatusUpdateInterval /t REG_DWORD /d 10 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v IPAddress /t REG_SZ /d 10.##.67.220 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v HWAddress /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v IPAddress /t REG_SZ /d 10.##.67.220 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v Protocol /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" /v StatusUpdateInterval /t REG_DWORD /d 10 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v Version /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Enabled" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v IPAddress /t REG_SZ /d 10.##.67.220 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Index" /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C net stop spooler & net start spooler' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v PortNumber /t REG_DWORD /d 9100 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" /v StatusUpdateEnabled /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C rundll32 printui.dll,PrintUIEntry /if /b "Canon iR2420 UFRII LT(7楼保安室打印机)" /f \\10.##.81.121\data\Customer_DEPT\打印驱动-勿删\UFRII_Driver_v2070_W32_ZH\Driver\CNLB0C.INF /r "IP_10.79.67.220" /m "C...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v HWAddress /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v Protocol /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v HostName /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.79.67.220" /v "SNMP Community" /t REG_SZ /d public /f' (with hidden window)
