Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"%WINDIR%\Vss\taskhost.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"%WINDIR%\Vss\taskhost.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe", "%WINDIR%\Vss\taskhost.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%WINDIR%\SchCache\firefox.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"%WINDIR%\SchCache\firefox.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe", "%WINDIR%\Vss\taskhost.exe", "%WINDIR%\SchCache\fire...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"C:\Users\Default User\sppsvc.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"C:\Users\Default User\sppsvc.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%ProgramFiles(x86)%\Windows Photo Viewer\en-US\services.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%ProgramFiles(x86)%\Windows Photo Viewer\en-US\services.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\sppsvcs
- <SYSTEM32>\tasks\sppsvc
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\services
Modifies file system
Creates the following files
- C:\users\public\recorded tv\sample media\sppsvc.exe
- C:\users\public\recorded tv\sample media\0a1fd5f707cd16
- %WINDIR%\vss\taskhost.exe
- %WINDIR%\vss\b75386f1303e64
- %WINDIR%\schcache\firefox.exe
- %WINDIR%\schcache\0fc223bdacedc3
- C:\users\default user\sppsvc.exe
- C:\users\default user\0a1fd5f707cd16
- %ProgramFiles(x86)%\windows photo viewer\en-us\services.exe
- %ProgramFiles(x86)%\windows photo viewer\en-us\c5b4cb5e9653cc
- %TEMP%\2rwus4sp.0.cs
- %TEMP%\2rwus4sp.cmdline
- %TEMP%\2rwus4sp.out
- %TEMP%\plcskfyfif
- %TEMP%\il7dfhyzzb.bat
- nul
- %HOMEPATH%\desktop\vmlritko.log
- %HOMEPATH%\desktop\olqdxill.log
- %HOMEPATH%\desktop\lkkhtavo.log
- %HOMEPATH%\desktop\siyhwppc.log
- %HOMEPATH%\desktop\alxhznas.log
- %HOMEPATH%\desktop\izvbfsfd.log
- %HOMEPATH%\desktop\fyogckpg.log
- %HOMEPATH%\desktop\mwcfezju.log
- %HOMEPATH%\desktop\jgmpxcjb.log
- %HOMEPATH%\desktop\rzvkeqen.log
- %HOMEPATH%\desktop\iqcuunyf.log
- %HOMEPATH%\desktop\gkhenjdn.log
- %HOMEPATH%\desktop\vvtywcdm.log
- %HOMEPATH%\desktop\svncsunp.log
- %HOMEPATH%\desktop\rptmlqsx.log
- %HOMEPATH%\desktop\ynhmofnm.log
- %HOMEPATH%\desktop\uxqvhimt.log
- %HOMEPATH%\desktop\srwgaera.log
- %HOMEPATH%\desktop\giwumuww.log
- %HOMEPATH%\desktop\fhnefzre.log
- %HOMEPATH%\desktop\kufdivgs.log
- %HOMEPATH%\desktop\sidyoald.log
- %HOMEPATH%\desktop\ybgxrfqr.log
- %TEMP%\ftxms10yen
- %TEMP%\8u3sqlbbv8.bat
- %HOMEPATH%\desktop\jcukznxv.log
- %HOMEPATH%\desktop\gcywfayy.log
- %HOMEPATH%\desktop\fmobcloc.log
- %HOMEPATH%\desktop\vdvmsiiv.log
- %HOMEPATH%\desktop\scfahfng.log
- %HOMEPATH%\desktop\qhkfehnj.log
- %HOMEPATH%\desktop\olfutohu.log
- %HOMEPATH%\desktop\ueitwtmj.log
- %HOMEPATH%\desktop\zrasyqbx.log
- %HOMEPATH%\desktop\hkjnfdwi.log
- %HOMEPATH%\desktop\oswhlymt.log
- %HOMEPATH%\desktop\osnsedgb.log
- %HOMEPATH%\desktop\dtjhrlqx.log
- %HOMEPATH%\desktop\rkkvdbvs.log
- %HOMEPATH%\desktop\znjwgafh.log
- %HOMEPATH%\desktop\wncacsqk.log
- %HOMEPATH%\desktop\mozppaah.log
- %HOMEPATH%\desktop\azljytzg.log
- %HOMEPATH%\desktop\ydgynaus.log
- %HOMEPATH%\desktop\wildkcuv.log
- %HOMEPATH%\desktop\jjbwtcou.log
- %HOMEPATH%\desktop\bvtmgddr.log
- %HOMEPATH%\desktop\mgzllpnu.log
- %TEMP%\df6dapr4js
- %TEMP%\ds6v954m6h.bat
Deletes the following files
- %TEMP%\2rwus4sp.cmdline
- %TEMP%\2rwus4sp.0.cs
- %TEMP%\2rwus4sp.out
- %TEMP%\plcskfyfif
- %TEMP%\ftxms10yen
- %TEMP%\df6dapr4js
Moves the following files
- from %ProgramFiles%\microsoft office\office14\bcssync.exe to %ProgramFiles%\microsoft office\office14\bcssync.exe.exe
Network activity
Connects to
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- '19#.#5.250.175':80
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\vss\taskhost.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Recorded TV\Sample Media\sppsvc.exe'" /rl HIGHEST /f
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2rwus4sp.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'%WINDIR%\Vss\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%WINDIR%\Vss\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'%WINDIR%\Vss\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%WINDIR%\SchCache\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\SchCache\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%WINDIR%\SchCache\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\sppsvc.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\IL7DfHyzZB.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\8u3sqlBbV8.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\ds6v954M6h.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\4kHW8Esv2t.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\EWktresicd.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Ng14EOm2tp.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\6bJqyfyFWM.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\WsfXZ1b1OE.bat"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2rwus4sp.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\IL7DfHyzZB.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\8u3sqlBbV8.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\ds6v954M6h.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\4kHW8Esv2t.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\EWktresicd.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Ng14EOm2tp.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\6bJqyfyFWM.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\WsfXZ1b1OE.bat"' (with hidden window)
