Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'fQNsZvucBQZE' = '"<Full path to file>"'
Creates the following files on removable media
- <Drive name for removable media>:\systemvolumeinformation\<File name>.exe
- <Drive name for removable media>:\autorun.inf
Modifies file system
Creates the following files
- %TEMP%\_mei00000be82\vcruntime140.dll
- %TEMP%\_mei00000be82\vcruntime140_1.dll
- %TEMP%\_mei00000be82\_bz2.pyd
- %TEMP%\_mei00000be82\_ctypes.pyd
- %TEMP%\_mei00000be82\_decimal.pyd
- %TEMP%\_mei00000be82\_hashlib.pyd
- %TEMP%\_mei00000be82\_lzma.pyd
- %TEMP%\_mei00000be82\_multiprocessing.pyd
- %TEMP%\_mei00000be82\_queue.pyd
- %TEMP%\_mei00000be82\_socket.pyd
- %TEMP%\_mei00000be82\_ssl.pyd
- %TEMP%\_mei00000be82\_wmi.pyd
- %TEMP%\_mei00000be82\_zstd.pyd
- %TEMP%\_mei00000be82\base_library.zip
- %TEMP%\_mei00000be82\certifi\cacert.pem
- %TEMP%\_mei00000be82\charset_normalizer\cd.cp314-win_amd64.pyd
- %TEMP%\_mei00000be82\charset_normalizer\md.cp314-win_amd64.pyd
- %TEMP%\_mei00000be82\libcrypto-3.dll
- %TEMP%\_mei00000be82\libffi-8.dll
- %TEMP%\_mei00000be82\libssl-3.dll
- %TEMP%\_mei00000be82\pyexpat.pyd
- %TEMP%\_mei00000be82\python314.dll
- %TEMP%\_mei00000be82\select.pyd
- %TEMP%\_mei00000be82\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei00000be82\unicodedata.pyd
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\systemvolumeinformation\<File name>.exe
- <Drive name for removable media>:\autorun.inf
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "F:SystemVolumeInformation"
- '<SYSTEM32>\attrib.exe' +h +s "F:SystemVolumeInformation"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "F:SystemVolumeInformation\<File name>.exe"
- '<SYSTEM32>\attrib.exe' +h +s "F:SystemVolumeInformation\<File name>.exe"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "F:autorun.inf"
- '<SYSTEM32>\attrib.exe' +h +s "F:autorun.inf"
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
