Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xwizard' = '"%APPDATA%\Microsoft\Windows\dllcache\xwizard.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'xwizard' = '"%APPDATA%\Microsoft\Windows\dllcache\xwizard.exe"'
- [<HKCU>\Software\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\Microsoft\Windows\dllcache\xwizard.exe"'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '"%APPDATA%\Microsoft\Windows\dllcache\xwizard.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\xwizard.lnk
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\dllcache\xwizard.exe
- %APPDATA%\microsoft\windows\dllcache\wdmaud.drv
- %APPDATA%\microsoft\windows\dllcache\f3ahvoas.dll
- %APPDATA%\microsoft\windows\dllcache\vdmdbg.dll
- %APPDATA%\microsoft\windows\dllcache\sbunattend.exe
- %APPDATA%\microsoft\windows\dllcache\iaspolcy.dll
- %APPDATA%\microsoft\windows\dllcache\sdbinst.exe
- %APPDATA%\microsoft\windows\dllcache\eappgnui.dll
- %APPDATA%\microsoft\windows\dllcache\eapp3hst.dll
- %APPDATA%\microsoft\windows\dllcache\biocredprov.dll
- %APPDATA%\microsoft\windows\dllcache\hnetcfg.dll
- %APPDATA%\microsoft\windows\dllcache\kbdfi.dll
- %APPDATA%\microsoft\windows\dllcache\oflc.rs
- %APPDATA%\microsoft\windows\dllcache\adsldp.dll
- %APPDATA%\microsoft\windows\dllcache\unimdm.tsp
- %APPDATA%\microsoft\windows\dllcache\boot.sdi
- %APPDATA%\microsoft\windows\dllcache\cero.rs
- %APPDATA%\microsoft\windows\dllcache\scrrun.dll
- %APPDATA%\microsoft\windows\dllcache\radardt.dll
- %APPDATA%\microsoft\windows\dllcache\tasklist.exe
- %APPDATA%\microsoft\windows\dllcache\pku2u.dll
- %APPDATA%\microsoft\windows\dllcache\iassam.dll
- %APPDATA%\microsoft\windows\dllcache\itvdata.dll
- %APPDATA%\microsoft\windows\dllcache\kbdintam.dll
- %APPDATA%\microsoft\windows\dllcache\xwizard.dtd
- %APPDATA%\microsoft\windows\dllcache\xcopy.exe
- %APPDATA%\microsoft\windows\dllcache\amxread.dll
- %APPDATA%\microsoft\windows\dllcache\ddrawex.dll
- %APPDATA%\microsoft\windows\dllcache\racengn.dll
- %APPDATA%\microsoft\windows\dllcache\logman.exe
- %APPDATA%\microsoft\windows\dllcache\wavemsp.dll
- %APPDATA%\microsoft\windows\dllcache\ias.dll
- %APPDATA%\microsoft\windows\dllcache\rdpd3d.dll
- %APPDATA%\microsoft\windows\dllcache\perfdisk.dll
- %APPDATA%\microsoft\windows\dllcache\gb2312.uce
- %APPDATA%\microsoft\windows\dllcache\samcli.dll
- %APPDATA%\microsoft\windows\dllcache\typelib.dll
- %APPDATA%\microsoft\windows\dllcache\ieakeng.dll
- %APPDATA%\microsoft\windows\dllcache\jscript.dll
- %APPDATA%\microsoft\windows\dllcache\scrptadm.dll
- %APPDATA%\microsoft\windows\dllcache\wls0wndh.dll
- %APPDATA%\microsoft\windows\dllcache\kbdbulg.dll
- %APPDATA%\microsoft\windows\dllcache\tapiui.dll
- %APPDATA%\microsoft\windows\dllcache\w32topl.dll
- %APPDATA%\microsoft\windows\dllcache\mlang.dat
- %APPDATA%\microsoft\windows\dllcache\compobj.dll
- %APPDATA%\microsoft\windows\dllcache\van.dll
- %APPDATA%\microsoft\windows\dllcache\chkdsk.exe
- %APPDATA%\microsoft\windows\dllcache\esrb.rs
- %APPDATA%\microsoft\windows\dllcache\magnify.exe
- %APPDATA%\microsoft\windows\dllcache\puiobj.dll
- %APPDATA%\microsoft\windows\dllcache\l2gpstore.dll
- %APPDATA%\microsoft\windows\dllcache\cacls.exe
- %APPDATA%\microsoft\windows\dllcache\efsadu.dll
- %APPDATA%\microsoft\windows\dllcache\d3d10warp.dll
- %APPDATA%\microsoft\windows\dllcache\pegi-fi.rs
- %APPDATA%\microsoft\windows\dllcache\naphlpr.dll
- %APPDATA%\microsoft\windows\dllcache\format.com
- %APPDATA%\microsoft\windows\dllcache\eappcfg.dll
- %APPDATA%\microsoft\windows\dllcache\fc.exe
- %APPDATA%\microsoft\windows\dllcache\verclsid.exe
- %APPDATA%\microsoft\windows\dllcache\napclcfg.msc
- %APPDATA%\microsoft\windows\dllcache\odbc32gt.dll
- %APPDATA%\microsoft\windows\dllcache\p2p.dll
- %APPDATA%\microsoft\windows\dllcache\kbdsorex.dll
- %APPDATA%\microsoft\windows\dllcache\audiodev.dll
- %APPDATA%\microsoft\windows\dllcache\bdaplgin.ax
- %APPDATA%\microsoft\windows\dllcache\basecsp.dll
- %APPDATA%\microsoft\windows\dllcache\webcheck.dll
- %APPDATA%\microsoft\windows\dllcache\dataclen.dll
- %APPDATA%\microsoft\windows\dllcache\cewmdm.dll
- %APPDATA%\microsoft\windows\dllcache\certpoleng.dll
- %APPDATA%\microsoft\windows\dllcache\taskschd.msc
- %APPDATA%\microsoft\windows\dllcache\catsrv.dll
- %APPDATA%\microsoft\windows\dllcache\kbdblr.dll
- %APPDATA%\microsoft\windows\dllcache\rasctrnm.h
- %APPDATA%\microsoft\windows\dllcache\hh.exe
- %APPDATA%\microsoft\windows\dllcache\wlancfg.dll
- %APPDATA%\microsoft\windows\dllcache\webio.dll
- %APPDATA%\microsoft\windows\dllcache\dbnetlib.dll
- %APPDATA%\microsoft\windows\dllcache\advpack.dll
- %APPDATA%\microsoft\windows\dllcache\aaclient.dll
- %APPDATA%\microsoft\windows\dllcache\odbcconf.dll
- %APPDATA%\microsoft\windows\dllcache\occache.dll
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\xwizard.lnk
- %TEMP%\tmp9cfd.tmp
- %APPDATA%\microsoft\windows\dllcache\rcx9cbd.tmp
- %APPDATA%\microsoft\windows\dllcache\rcx9c6e.tmp
- %TEMP%\tmp9bc2.tmp
- %APPDATA%\microsoft\windows\dllcache\mfc100deu.dll
- %APPDATA%\microsoft\windows\dllcache\objsel.dll
- %APPDATA%\microsoft\windows\dllcache\pid.dll
- %APPDATA%\microsoft\windows\dllcache\cabinet.dll
- %APPDATA%\microsoft\windows\dllcache\hhctrl.ocx
- %APPDATA%\microsoft\windows\dllcache\lcptr.tbl
- %APPDATA%\microsoft\windows\dllcache\iasdatastore.dll
- %APPDATA%\microsoft\windows\dllcache\html.iec
- %APPDATA%\microsoft\windows\dllcache\sbeio.dll
- %APPDATA%\microsoft\windows\dllcache\taskmgr.exe
- %APPDATA%\microsoft\windows\dllcache\l2nacp.dll
- %APPDATA%\microsoft\windows\dllcache\vbicodec.ax
- %APPDATA%\microsoft\windows\dllcache\p2pcollab.dll
- %APPDATA%\microsoft\windows\dllcache\ndfhcdiscovery.dll
- %APPDATA%\microsoft\windows\dllcache\mpeg2data.ax
- %APPDATA%\microsoft\windows\dllcache\t2embed.dll
- %APPDATA%\microsoft\windows\dllcache\rasautou.exe
- %APPDATA%\microsoft\windows\dllcache\xpsfilt.dll
- %APPDATA%\microsoft\windows\dllcache\ctfmon.exe
- %APPDATA%\microsoft\windows\dllcache\d3d10core.dll
- %APPDATA%\microsoft\windows\dllcache\cca.dll
- %APPDATA%\microsoft\windows\dllcache\aclui.dll
- %APPDATA%\microsoft\windows\dllcache\kbdtuq.dll
- %APPDATA%\microsoft\windows\dllcache\certcli.dll
- %APPDATA%\microsoft\windows\dllcache\fltlib.dll
- %APPDATA%\microsoft\windows\dllcache\els.dll
- %APPDATA%\microsoft\windows\dllcache\qmgrprxy.dll
- %APPDATA%\microsoft\windows\dllcache\kbdtajik.dll
- %APPDATA%\microsoft\windows\dllcache\iac25_32.ax
- %APPDATA%\microsoft\windows\dllcache\ndadmin.exe
- %APPDATA%\microsoft\windows\dllcache\kbd101.dll
- %APPDATA%\microsoft\windows\dllcache\devobj.dll
- %APPDATA%\microsoft\windows\dllcache\gcdef.dll
- %APPDATA%\microsoft\windows\dllcache\kbdinguj.dll
- %APPDATA%\microsoft\windows\dllcache\xmlprovi.dll
Deletes the following files
- %TEMP%\tmp9bc2.tmp
- %TEMP%\tmp9cfd.tmp
Moves the following files
- from %APPDATA%\microsoft\windows\dllcache\rcx9c6e.tmp to %APPDATA%\microsoft\windows\dllcache\xwizard.exe
- from %APPDATA%\microsoft\windows\dllcache\rcx9cbd.tmp to %APPDATA%\microsoft\windows\dllcache\xwizard.exe
Network activity
Connects to
- '46.##5.244.150':666
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\dllcache\xwizard.exe'
