Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\audiodga
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\<File name>o
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\wmiprvsew
- <SYSTEM32>\tasks\wmiprvse
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\mntemp
- %TEMP%\owuzmmu4y0
- %ProgramFiles(x86)%\winamp\lang\24dbde2999530e
- %ProgramFiles(x86)%\winamp\lang\wmiprvse.exe
- %ProgramFiles(x86)%\windows photo viewer\en-us\b75386f1303e64
- %ProgramFiles(x86)%\windows photo viewer\en-us\taskhost.exe
- <Current directory>\cc11b995f2a76d
- <Current directory>\winlogon.exe
- C:\far2\addons\xlat\russian\480b7989c529f6
- C:\far2\addons\xlat\russian\wudfhost.exe
- %WINDIR%\serviceprofiles\networkservice\desktop\886983d96e3d3e
- %WINDIR%\serviceprofiles\networkservice\desktop\csrss.exe
- %HOMEPATH%\6ccacd8608530f
- %HOMEPATH%\idle.exe
- C:\totalcmd\language\42af1c969fbb7b
- C:\totalcmd\language\audiodg.exe
- <Current directory>\480b7989c529f6
- <Current directory>\wudfhost.exe
- %ALLUSERSPROFILE%\application data\6cb0b6c459d5d3
- %ALLUSERSPROFILE%\application data\dwm.exe
- C:\totalcmd\language\9db6e019d4f04e
- C:\totalcmd\language\iexplore.exe
- %ProgramFiles(x86)%\steam\appcache\96c14d7d7ba9b5
- %ProgramFiles(x86)%\steam\appcache\<File name>.exe
- C:\totalcmd\language\7a0fd90576e088
- C:\totalcmd\language\explorer.exe
- %ProgramFiles(x86)%\windows photo viewer\en-us\42af1c969fbb7b
- %ProgramFiles(x86)%\windows photo viewer\en-us\audiodg.exe
- %TEMP%\zfd3rigixh.bat
- nul
Deletes the following files
- %TEMP%\owuzmmu4y0
Network activity
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\explorer.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\iexplore.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Steam\appcache\<File name>.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\WUDFHost.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\audiodg.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%HOMEPATH%\Idle.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\ServiceProfiles\NetworkService\Desktop\csrss.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Addons\XLat\Russian\WUDFHost.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\winlogon.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Winamp\Lang\WmiPrvSE.exe'
- '%HOMEPATH%\idle.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\zFD3riGixh.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'%WINDIR%\ServiceProfiles\NetworkService\Desktop\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\Far2\Addons\XLat\Russian\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Far2\Addons\XLat\Russian\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Far2\Addons\XLat\Russian\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'<Current directory>\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Winamp\Lang\WmiPrvSE.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Winamp\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Winamp\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Photo Viewer\en-US\audiodg.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Application Data\dwm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Photo Viewer\en-US\taskhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\zFD3riGixh.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'%WINDIR%\ServiceProfiles\NetworkService\Desktop\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\ServiceProfiles\NetworkService\Desktop\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'%HOMEPATH%\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%HOMEPATH%\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'%HOMEPATH%\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>o" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Steam\appcache\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Steam\appcache\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>o" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Steam\appcache\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /f
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Application Data\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'%ALLUSERSPROFILE%\Application Data\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'<Current directory>\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'%ALLUSERSPROFILE%\Application Data\dwm.exe'" /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
