Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'system recover' = '"%ProgramFiles(x86)%\Microsoft Analysis Services\Tewupigyny.exe"'
Modifies file system
Creates the following files
- %TEMP%\is-55jk2.tmp\<File name>.tmp
- %TEMP%\d4h5ff4y.src\josetp.exe
- %ProgramFiles(x86)%\ultramediaburner\unins000.dat
- C:\users\public\desktop\ultramediaburner.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ultramediaburner.lnk
- %ProgramFiles(x86)%\ultramediaburner\is-vd1lo.tmp
- %ProgramFiles(x86)%\ultramediaburner\is-3aoll.tmp
- %ProgramFiles(x86)%\microsoft analysis services\tewupigyny.exe.config
- %ProgramFiles(x86)%\microsoft analysis services\tewupigyny.exe
- %TEMP%\0a-c7e5c-87c-2a196-bca884e3701c8\zhutefuragy.exe.config
- %TEMP%\0a-c7e5c-87c-2a196-bca884e3701c8\zhutefuragy.exe
- %TEMP%\zakh24yr.ppj\gcleanereu.exe
- %TEMP%\is-8m1am.tmp\_isetup\_shfoldr.dll
- %TEMP%\0a-c7e5c-87c-2a196-bca884e3701c8\kenessey.txt
- %TEMP%\11-98d6e-024-2e383-8d3114b7c3e03\zhorymicaxae.exe.config
- %TEMP%\11-98d6e-024-2e383-8d3114b7c3e03\zhorymicaxae.exe
- %TEMP%\is-7kc2a.tmp\ultramediaburner.tmp
- %ProgramFiles%\mfpmp\ncsmiuspzo\ultramediaburner.exe.config
- %ProgramFiles%\mfpmp\ncsmiuspzo\ultramediaburner.exe
- %TEMP%\is-630ke.tmp\daldoula.exe
- %TEMP%\is-630ke.tmp\idp.dll
- %TEMP%\is-630ke.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-630ke.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8m1am.tmp\_isetup\_setup64.tmp
- %TEMP%\4eggis3m.qua\gcleaner.exe
Deletes the following files
- %TEMP%\is-630ke.tmp\daldoula.exe
- %TEMP%\is-630ke.tmp\idp.dll
- %TEMP%\is-630ke.tmp\_isetup\_setup64.tmp
- %TEMP%\is-630ke.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-55jk2.tmp\<File name>.tmp
Moves the following files
- from %ProgramFiles(x86)%\ultramediaburner\is-3aoll.tmp to %ProgramFiles(x86)%\ultramediaburner\unins000.exe
- from %ProgramFiles(x86)%\ultramediaburner\is-vd1lo.tmp to %ProgramFiles(x86)%\ultramediaburner\ultramediaburner.exe
Network activity
Connects to
- 'mo######t-link-download.com':80
- 'microsoft.com':80
- 'pr#####investig8tor.com':80
- 'google.com':80
- 'co###ctini.net':443
- 'cd#.##scordapp.com':443
- 'so#####.boys4dayz.com':443
- 'ca###.uutww77.com':80
- 'a.###tagame.com':443
- '2f######vacytoolsforyou.xyz':80
TCP
HTTP GET requests
- http://mo######t-link-download.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/publish/qb8zr5zmpb2n6ea.exe
- http://mo######t-link-download.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/kenpa/a5ap52bdw952kqx.exe
- http://mo######t-link-download.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/keyHandler/pzamcx87wcuq5kn.exe
- http://gc###tnrs.top/installer.php?pu######
HTTP POST requests
- http://pr#####investig8tor.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
Other
- 'co###ctini.net':443
- 'pr#######etrustednetwork.com':443
- 'cd#.##scordapp.com':443
- 'so#####.boys4dayz.com':443
- 'a.###tagame.com':443
UDP
- DNS ASK su#####ationcity.com
- DNS ASK mo######t-link-download.com
- DNS ASK co###ctini.net
- DNS ASK microsoft.com
- DNS ASK pr#####investig8tor.com
- DNS ASK google.com
- DNS ASK pr#######etrustednetwork.com
- DNS ASK gc###tnrs.top
- DNS ASK cd#.##scordapp.com
- DNS ASK so#####.boys4dayz.com
- DNS ASK ht####ownload.pw
- DNS ASK ca###.uutww77.com
- DNS ASK a.###tagame.com
- DNS ASK 2f######vacytoolsforyou.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\is-55jk2.tmp\<File name>.tmp' /SL5="$B01EC,506127,422400,<Full path to file>"
- '%TEMP%\is-630ke.tmp\daldoula.exe' /S /UID=burnerch2
- '%ProgramFiles%\mfpmp\ncsmiuspzo\ultramediaburner.exe' /VERYSILENT
- '%TEMP%\is-7kc2a.tmp\ultramediaburner.tmp' /SL5="$C0020,281924,62464,%ProgramFiles%\mfpmp\NCSMIUSPZO\ultramediaburner.exe" /VERYSILENT
- '%TEMP%\11-98d6e-024-2e383-8d3114b7c3e03\zhorymicaxae.exe'
- '%TEMP%\0a-c7e5c-87c-2a196-bca884e3701c8\zhutefuragy.exe'
- '%ProgramFiles(x86)%\ultramediaburner\ultramediaburner.exe' -silent -desktopShortcut -programMenu
- '%TEMP%\d4h5ff4y.src\josetp.exe'
- '%TEMP%\is-630ke.tmp\daldoula.exe' /S /UID=burnerch2' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\zakh24yr.ppj\GcleanerEU.exe /eufive & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\d4h5ff4y.src\JoSetp.exe & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\4eggis3m.qua\gcleaner.exe /mixfive & exit' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://www.pr#######etrustednetwork.com/e2q8zu9hu?ke##################################
- '<SYSTEM32>\cmd.exe' /k %TEMP%\zakh24yr.ppj\GcleanerEU.exe /eufive & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\d4h5ff4y.src\JoSetp.exe & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\4eggis3m.qua\gcleaner.exe /mixfive & exit
