Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 6e38b05297f2c919
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WinDefend] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{C286B2F2-5E4F-4BB6-A7DF-E23D859FC798}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{20E5416D-2133-4450-87A3-B36A52B7E59B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0A733504-4BA8-43AC-BF9B-4B195CDFD94B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Modifies file system
Creates the following files
- <SYSTEM32>\grouppolicy\gpt.ini
- %HOMEPATH%\pictures\minor policy\2s9heububzvp6amfxnqem7pq.exe
- %HOMEPATH%\pictures\minor policy\o0eev9cntphy2evndvggfogp.exe
- %HOMEPATH%\pictures\minor policy\p9ftk2ichi0rlx1behvtqeig.exe
- %HOMEPATH%\pictures\minor policy\2x7izffe3sbatqepvlavnizf.exe
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\fgcscge
- %HOMEPATH%\pictures\minor policy\wefcsabpjm0gvhsitoxppmdw.exe
- %HOMEPATH%\pictures\minor policy\s_7qnv5vzigsti55aaiw_r2x.exe
- %HOMEPATH%\pictures\minor policy\5hphewqoepuaiei17vfxq9ph.exe
- %HOMEPATH%\pictures\minor policy\ecopht_aix_iucdkevex3taa.exe
- %HOMEPATH%\pictures\minor policy\m_o0vxk8fqhzkjnxl2tw7dul.exe
- %HOMEPATH%\pictures\minor policy\knqnxulz6u2oeclzwkytz_3w.exe
- %HOMEPATH%\pictures\minor policy\veprkxdwfww47a_vyxy4tyvg.exe
- %HOMEPATH%\pictures\minor policy\eylsazuix1shcgjhevubn4q1.exe
- %HOMEPATH%\pictures\minor policy\wjxkpn78bcxbvtgy5gnzg0vd.exe
- %HOMEPATH%\pictures\minor policy\ourulescdzkkva5h7kwsk26t.exe
- %HOMEPATH%\pictures\minor policy\fjaqis6gesu_i4rjixise_qg.exe
- %HOMEPATH%\pictures\minor policy\vmfe61kfp1voufrnifnomcza.exe
- %HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe
- %HOMEPATH%\pictures\minor policy\d76cfjmjtai4azos2blcsndi.exe
- %HOMEPATH%\pictures\minor policy\bk851xjq8jkk2ra6yiqltct0.exe
- %HOMEPATH%\pictures\minor policy\1ccnighrf3gzndbwvjak_dk7.exe
- %HOMEPATH%\pictures\minor policy\orfi8cnf_8wajlwcxbhgt_59.exe
- %ALLUSERSPROFILE%\ntuser.pol
- <SYSTEM32>\grouppolicy\machine\registry.pol
- %HOMEPATH%\pictures\minor policy\slufbmscha7enim8bm_j4ivj.exe
- %TEMP%\207aa4515d\oneetx.exe
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\tempntuser.pol
- %APPDATA%\fgcscge
Deletes the following files
- %ALLUSERSPROFILE%\tempntuser.pol
- %HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe
- <SYSTEM32>\tasks\microsoft\windows defender\mpidletask
Moves the following files
- from %ALLUSERSPROFILE%\ntuser.pol to %ALLUSERSPROFILE%\tempntuser.pol
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %ALLUSERSPROFILE%\tempntuser.pol
Network activity
Connects to
- '94.##2.138.113':80
- 'yandex.ru':443
- 'ip##s.ru':443
- 'ip###ger.org':443
- 'dz#n.ru':443
- 'po###ulit.org':80
- 't.#e':443
- 'hu###lior.net':80
- '94.##2.138.131':80
- 'wi####campbell.top':80
- '19#.#2.32.118':80
- 'bu###u55t.net':80
- 'db##p.com':443
- 'ap#.#b-ip.com':443
- 'so###tlic4.net':80
- 'ir##host.io':443
- '45.#.74.80':80
- 'ma##ind.com':80
- 'ma##ind.com':443
- 'ch####sjones.top':80
- 'tw##ter.com':443
- '45.##.156.229':80
- 'te###ram.org':443
- 'x2.#.lencr.org':80
- 'ip##fo.io':443
- 'vk.com':80
- 'vk.com':443
- '94.##6.253.187':80
- '87.##1.221.58':80
- '19#.#69.175.232':80
- 'hu##rsi.com':80
- 'bi###cket.org':80
- 'no####sa5org.org':80
- 'st####ommunity.com':443
- 'pr###ncert.pw':80
- 'pr###ncert.pw':443
- 'bi###cket.org':443
- 'ag##v.com':443
- 'su####3.userapi.com':443
- 'ps##.#serapi.com':443
- 'su####8.userapi.com':443
- 'ap#.#yip.com':80
- 'x1.#.lencr.org':80
- 'ap#.#yip.com':443
- 'ag##v.com':80
- 'to###olihul.net':80
TCP
HTTP GET requests
- http://hu##rsi.com/dl/6523.exe
- http://94.##6.253.187/download/Services.exe
- http://87.##1.221.58/g.exe
- http://wi####campbell.top/calc2.exe
- http://19#.#69.175.232/autorun.exe
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
- http://94.##2.138.113/api/tracemap.php
- http://94.##2.138.131/api/tracemap.php
- http://19#.#2.32.118/api/tracemap.php
- http://www.ma##ind.com/geoip/v2.1/city/me
- http://45.#.74.80/ummaa.exe
- http://45.#.74.80/super.exe
- http://45.##.156.229/api/tracemap.php
HTTP POST requests
- http://po###ulit.org/
- http://hu###lior.net/
- http://bu###u55t.net/
- http://so###tlic4.net/
- http://no####sa5org.org/
Other
- 'ap#.#yip.com':443
- 'st####ommunity.com':443
- 'sso.passport.yandex.ru':443
- 'dz#n.ru':443
- 'ip###ger.org':443
- 'ip##s.ru':443
- 'yandex.ru':443
- 'tw##ter.com':443
- 'te###ram.org':443
- 'su####8.userapi.com':443
- 'ir##host.io':443
- 'ps##.#serapi.com':443
- 'bi###cket.org':443
- 'su####3.userapi.com':443
- 'pr###ncert.pw':443
- 'ag##v.com':80
- 'bi###cket.org':80
- 'pr###ncert.pw':80
- 'vk.com':443
- 'vk.com':80
- 'ip##fo.io':443
- 'ag##v.com':443
- 'ma##ind.com':443
UDP
- DNS ASK ap#.#yip.com
- DNS ASK po###ulit.org
- DNS ASK dz#n.ru
- DNS ASK t.#e
- DNS ASK sso.passport.yandex.ru
- DNS ASK hu###lior.net
- DNS ASK st####ommunity.com
- DNS ASK db##p.com
- DNS ASK nu###jnuli.org
- DNS ASK so###tlic4.net
- DNS ASK ap#.#b-ip.com
- DNS ASK ir##host.io
- DNS ASK no####sa5org.org
- DNS ASK ma##ind.com
- DNS ASK 23#######721824.bal.ala48.top
- DNS ASK ip###ger.org
- DNS ASK bu###u55t.net
- DNS ASK ip##s.ru
- DNS ASK ag##v.com
- DNS ASK ip##fo.io
- DNS ASK vk.com
- DNS ASK pr###ncert.pw
- DNS ASK wi####campbell.top
- DNS ASK hu##rsi.com
- DNS ASK bi###cket.org
- DNS ASK su####3.userapi.com
- DNS ASK tw##ter.com
- DNS ASK ps##.#serapi.com
- DNS ASK su####8.userapi.com
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK te###ram.org
- DNS ASK ch####sjones.top
- DNS ASK yandex.ru
- DNS ASK to###olihul.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\pictures\minor policy\wefcsabpjm0gvhsitoxppmdw.exe'
- '%HOMEPATH%\pictures\minor policy\5hphewqoepuaiei17vfxq9ph.exe'
- '%TEMP%\207aa4515d\oneetx.exe'
- '%HOMEPATH%\pictures\minor policy\slufbmscha7enim8bm_j4ivj.exe'
- '%HOMEPATH%\pictures\minor policy\2s9heububzvp6amfxnqem7pq.exe'
- '%HOMEPATH%\pictures\minor policy\eylsazuix1shcgjhevubn4q1.exe'
- '%HOMEPATH%\pictures\minor policy\m_o0vxk8fqhzkjnxl2tw7dul.exe'
- '%HOMEPATH%\pictures\minor policy\ourulescdzkkva5h7kwsk26t.exe'
- '%HOMEPATH%\pictures\minor policy\bk851xjq8jkk2ra6yiqltct0.exe'
- '%HOMEPATH%\pictures\minor policy\o0eev9cntphy2evndvggfogp.exe'
- '%HOMEPATH%\pictures\minor policy\s_7qnv5vzigsti55aaiw_r2x.exe'
- '%HOMEPATH%\pictures\minor policy\ecopht_aix_iucdkevex3taa.exe'
- '%HOMEPATH%\pictures\minor policy\veprkxdwfww47a_vyxy4tyvg.exe'
- '%HOMEPATH%\pictures\minor policy\d76cfjmjtai4azos2blcsndi.exe'
- '%HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe'
- '%HOMEPATH%\pictures\minor policy\vmfe61kfp1voufrnifnomcza.exe'
- '%HOMEPATH%\pictures\minor policy\fjaqis6gesu_i4rjixise_qg.exe'
- '%HOMEPATH%\pictures\minor policy\1ccnighrf3gzndbwvjak_dk7.exe'
- '%HOMEPATH%\pictures\minor policy\o0eev9cntphy2evndvggfogp.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\d76cfjmjtai4azos2blcsndi.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\2s9heububzvp6amfxnqem7pq.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\vmfe61kfp1voufrnifnomcza.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\wefcsabpjm0gvhsitoxppmdw.exe' ' (with hidden window)
- '%TEMP%\207aa4515d\oneetx.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\eylsazuix1shcgjhevubn4q1.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\slufbmscha7enim8bm_j4ivj.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\ecopht_aix_iucdkevex3taa.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\fjaqis6gesu_i4rjixise_qg.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\oneetx.exe" /F' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\ourulescdzkkva5h7kwsk26t.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\t88zfxerqmrcxdti4nadgpdu.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\1ccnighrf3gzndbwvjak_dk7.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\s_7qnv5vzigsti55aaiw_r2x.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\veprkxdwfww47a_vyxy4tyvg.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\5hphewqoepuaiei17vfxq9ph.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\m_o0vxk8fqhzkjnxl2tw7dul.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\bk851xjq8jkk2ra6yiqltct0.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\207aa4515d" /P "user:N"&&CACLS "..\207aa4515d" /P "user:R" /E&&Exit' (with hidden window)
Executes the following
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\oneetx.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\207aa4515d" /P "user:N"&&CACLS "..\207aa4515d" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\regsvr32.exe' -S .\9XxKyCG.Y /u
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "oneetx.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "oneetx.exe" /P "user:R" /E
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '%WINDIR%\syswow64\cacls.exe' "..\207aa4515d" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "..\207aa4515d" /P "user:R" /E
