Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '0dc235fc6220c7a63c91e5b6a297c21d' = '"%TEMP%\csrsss.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '0dc235fc6220c7a63c91e5b6a297c21d' = '"%TEMP%\csrsss.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\0dc235fc6220c7a63c91e5b6a297c21d.exe
Creates the following files on removable media
- <Drive name for removable media>:\svchost.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\csrsss.exe" "csrsss.exe" ENABLE
- '%WINDIR%\syswow64\taskkill.exe' /F /IM taskmgr.exe
Modifies file system
Creates the following files
- %APPDATA%\start.bat
- %APPDATA%\21.exe
- %APPDATA%\server.exe
- %TEMP%\csrsss.exe
- C:\svchost.exe
- C:\autorun.inf
- D:\svchost.exe
- D:\autorun.inf
Sets the 'hidden' attribute to the following files
- %APPDATA%\server.exe
- %TEMP%\csrsss.exe
- C:\svchost.exe
- C:\autorun.inf
- D:\svchost.exe
- D:\autorun.inf
- <Drive name for removable media>:\svchost.exe
- <Drive name for removable media>:\autorun.inf
Network activity
Connects to
- '46.##3.131.237':7777
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\21.exe' -p0321654987 -d%APPDATA%
- '%APPDATA%\server.exe'
- '%TEMP%\csrsss.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\csrsss.exe" "csrsss.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM taskmgr.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\start.bat" "
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %APPDATA%\FortniteFPSBBOSTEYHEDN.cfg
