Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\Microsoft\Windows\CurrentVersion\Run] '0bbd2b07bbb34c7017fe80cc05f64a7b' = '"%TEMP%\server.exe" ..'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '0bbd2b07bbb34c7017fe80cc05f64a7b' = '"%TEMP%\server.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\0bbd2b07bbb34c7017fe80cc05f64a7b.exe
Creates the following files on removable media
- <Drive name for removable media>:\0bbd2b07bbb34c7017fe80cc05f64a7b.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\xsandbox.bin.__tmp__
- %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\manifests\33_boxed.exe_0x8a271af63fc591fb85b2f21d2ca2a9d4.1.manifest.__tmp__
- %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\winrar sfx.manifest.__tmp__
- %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\x86_winrar sfx@1.0.0.0.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe.manifest.__tmp__
- %TEMP%\rarsfx0\33_boxed.exe
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe.manifest.__tmp__
- %TEMP%\server.exe
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.manifest.__tmp__
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\0bbd2b07bbb34c7017fe80cc05f64a7b.exe
- <Drive name for removable media>:\autorun.inf
- %TEMP%\server.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\0bbd2b07bbb34c7017fe80cc05f64a7b.exe
Moves the following files
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\xsandbox.bin.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\xsandbox.bin
- from %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\manifests\33_boxed.exe_0x8a271af63fc591fb85b2f21d2ca2a9d4.1.manifest.__tmp__ to %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\manifests\33_boxed.exe_0x8a271af63fc591fb85b2f21d2ca2a9d4.1.manifest
- from %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\winrar sfx.manifest.__tmp__ to %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\winrar sfx.manifest
- from %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\x86_winrar sfx@1.0.0.0.manifest.__tmp__ to %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\x86_winrar sfx@1.0.0.0.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.manifest
Network activity
UDP
- DNS ASK em######ount01.myq-see.com
- DNS ASK em######count01.ddns.net
- DNS ASK em######count02.ddns.net
- DNS ASK em######count03.ddns.net
- DNS ASK em#######ount01.publicvm.com
- DNS ASK em#######ount03.publicvm.com
- DNS ASK em######count03.linkpc.net
- DNS ASK em######ount02.myq-see.com
- DNS ASK em######count04.ddns.net
- DNS ASK em######count01.linkpc.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdf2683b0dadea0c6\33_boxed.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\33_boxed.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xc7b069a3519fd404\server.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8' (with hidden window)
