Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- <SYSTEM32>\tasks\iexplore__-pu
- %APPDATA%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- <SYSTEM32>\tasks\firefox__-pu
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\iexplore__-pu] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\iexplore__-pu] 'ImagePath' = 'C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\firefox__-pu] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\firefox__-pu] 'ImagePath' = 'C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\iexplore__-pu] 'ImagePath' = 'C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe'
Creates the following services
- 'iexplore__-pu' C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- 'firefox__-pu' C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- 'iexplore__-pu' C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM iexplore__.exe /F
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes
- '<SYSTEM32>\taskkill.exe' /IM firefox__.exe /F
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=out action=allow program="C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=in action=allow program="C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes
Modifies file system
Creates the following files
- C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcxc1f9.tmp
- C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcxc286.tmp
- C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcxc2f5.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxd97b.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxda18.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxda96.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcxf0fe.tmp
- C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcxf16c.tmp
- C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcxf1ea.tmp
- %ALLUSERSPROFILE%\exec_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\payload\monitor.zip
- %ALLUSERSPROFILE%\exec_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\payload\commander32.dll
- %ALLUSERSPROFILE%\exec_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\payload\commander64.dll
- %ALLUSERSPROFILE%\exec_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\cfg
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxfb4.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx1023.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx10a1.tmp
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\payload\publisher.zip
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\payload\publisher32.dll
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\payload\publisher64.dll
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\cfg
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx30cc.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx313a.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx31a9.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx467a.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx46d9.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx4737.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx6252.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx62c0.tmp
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx632f.tmp
Deletes following files that it created itself
- <SYSTEM32>\tasks\iexplore__-pu
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- <SYSTEM32>\tasks\firefox__-pu
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\payload\publisher.zip
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\payload\publisher32.dll
- %ALLUSERSPROFILE%\prox_-zcztvhocjjuqhaddo0br7yvtmuejjy66ezyt2qe9fw\proxy\payload\publisher64.dll
- C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
Moves the following files
- from C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcxc1f9.tmp to C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- from C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcxc286.tmp to C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- from C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\rcxc2f5.tmp to C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxd97b.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxda18.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxda96.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcxf0fe.tmp to C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcxf16c.tmp to C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcxf1ea.tmp to C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx1023.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx10a1.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx313a.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx31a9.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx46d9.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx4737.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx62c0.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx632f.tmp to C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
Substitutes the following files
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
Network activity
Connects to
- 'ap#.#ithub.com':443
- 'oc##.#ectigo.com':80
- 're#########ets.githubusercontent.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1e##############
Other
- 'ap#.#ithub.com':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
UDP
- DNS ASK ap#.#ithub.com
- DNS ASK oc##.#ectigo.com
- DNS ASK gi##ub.com
- DNS ASK re#########ets.githubusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\net.exe' start
- '<SYSTEM32>\net1.exe' start
- '<SYSTEM32>\sc.exe' delete iexplore__-pu
- '<SYSTEM32>\schtasks.exe' /delete /tn "iexplore__-pu" /f
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' delete firefox__-pu
- '<SYSTEM32>\schtasks.exe' /delete /tn "firefox__-pu" /f
- '<SYSTEM32>\sc.exe' create "firefox__-pu" binPath= "C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox__-pu" /tr "C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' query "firefox__-pu"
- '<SYSTEM32>\sc.exe' query "iexplore__-pu"
- '<SYSTEM32>\net.exe' start' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM iexplore__.exe /F' (with hidden window)
- '<SYSTEM32>\sc.exe' delete iexplore__-pu' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "iexplore__-pu" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\51200437\4254ed6b974270c984db5307dac954f17eac79d461d08fca8fd2d32e71b67397\iexplore__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM firefox__.exe /F' (with hidden window)
- '<SYSTEM32>\sc.exe' delete firefox__-pu' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "firefox__-pu" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create "firefox__-pu" binPath= "C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=out action=allow program="C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=in action=allow program="C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox__-pu" /tr "C:\51200437\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\51200437\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\sc.exe' query "firefox__-pu"' (with hidden window)
- '<SYSTEM32>\sc.exe' query "iexplore__-pu"' (with hidden window)
