Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%APPDATA%\Microsoft\SystemCertificates\My\Certificates\soma.vbs'
Malicious functions
Creates and executes the following (exploit)
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\soma.vbs A C
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%APPDATA%\Microsoft\SystemCertificates\My\Certificates\soma.vbs'
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\soma.vbs A C
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $37BE7CD97CBF2952A2A0E7BBD79294351D9451BE42850F277886BCA1CD88=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...
Injects code into
the following system processes:
- %WINDIR%\syswow64\calc.exe
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\systray.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %TEMP%\soma.vbs
- %APPDATA%\microsoft\systemcertificates\my\certificates\soma.vbs
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ffbc9ff291795647a5236ac884aa68b0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\98ffc3d762c64a3b5de1605bb6b195fb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b9f6d148dd66fb0474189bd6894320e8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\45d2b3939da02f0624d644577e914595_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\519575f147accd18905db130cc4cbf17_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7eef3069a8a6df9e618aa04d2117d731_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b82d71a7ef50bba37f6b3f5cb1249657_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8163121a97acfda107cd26dc2241676b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4de7e343c5204ed309e6fd6befa64084_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d7e9a787f80ec072582f17434be84fc1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e03a591f412babd60d126e3382729492_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3e32435028fddae1500d46890c6f874b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7e3019380436db1bfabf07a221ee02ca_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\eee43ea4288faabde563ba1f0d1ddb4d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Deletes the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ffbc9ff291795647a5236ac884aa68b0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\98ffc3d762c64a3b5de1605bb6b195fb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b9f6d148dd66fb0474189bd6894320e8_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\45d2b3939da02f0624d644577e914595_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\519575f147accd18905db130cc4cbf17_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7eef3069a8a6df9e618aa04d2117d731_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b82d71a7ef50bba37f6b3f5cb1249657_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8163121a97acfda107cd26dc2241676b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4de7e343c5204ed309e6fd6befa64084_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d7e9a787f80ec072582f17434be84fc1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\e03a591f412babd60d126e3382729492_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3e32435028fddae1500d46890c6f874b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7e3019380436db1bfabf07a221ee02ca_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\eee43ea4288faabde563ba1f0d1ddb4d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Network activity
TCP
HTTP GET requests
- http://www.as####kasounds.com/upfiles/up_down/d167b3a3f9d124596d50655ec0c51a34.mp3
- http://www.as####kasounds.com/upfiles/up_down/83dcf1a7bff876e5ad706d2eb25c3e94.mp3
UDP
- DNS ASK as####kasounds.com
- DNS ASK sh###flairs.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\soma.vbs A C' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $37BE7CD97CBF2952A2A0E7BBD79294351D9451BE42850F277886BCA1CD88=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-Item -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Value '%APPDATA%\Microsoft\SystemCertificates\My\Certificates\soma.vbs'' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C CopY "%TEMP%\soma.vbs" "%APPDATA%\Microsoft\SystemCertificates\My\Certificates" /Y' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c sc query wcncsvc >> A C
- '<SYSTEM32>\cmd.exe' /C CopY "%TEMP%\soma.vbs" "%APPDATA%\Microsoft\SystemCertificates\My\Certificates" /Y
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\systray.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\calc.exe"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
