Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\techharbor.url
- <SYSTEM32>\tasks\corners
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\specials.mpeg
- %TEMP%\rose.mpeg
- %TEMP%\diameter.mpeg
- %TEMP%\connecticut.mpeg
- %TEMP%\alarm.mpeg
- %TEMP%\producers.mpeg
- %TEMP%\clinics.mpeg
- %TEMP%\really.mpeg
- %TEMP%\orange.mpeg
- %TEMP%\diameter.mpeg.bat
- %TEMP%\age
- %TEMP%\swingers
- %TEMP%\innovations
- %TEMP%\games
- %TEMP%\shows
- %TEMP%\inform
- %TEMP%\gave
- %TEMP%\mitsubishi
- %TEMP%\kind
- %TEMP%\91885\bookmark.com
- %TEMP%\91885\c
- %LOCALAPPDATA%\maritimetech dynamics\q
- %LOCALAPPDATA%\maritimetech dynamics\techharbor.com
- %LOCALAPPDATA%\maritimetech dynamics\techharbor.js
- %APPDATA%\0cb67e2f-dc95-45ca-8fb8-69bde8e3f814\run.dat
Deletes the following files
- %TEMP%\91885\c
Deletes itself.
Network activity
Connects to
- 'jk####.duckdns.org':8570
UDP
- DNS ASK gu########QtyNncN.guXfPEgCesQtyNncN
- DNS ASK jk####.duckdns.org
Miscellaneous
Creates and executes the following
- '%TEMP%\91885\bookmark.com' c
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy Diameter.mpeg Diameter.mpeg.bat & Diameter.mpeg.bat
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "opssvc wrsa"
- '%WINDIR%\syswow64\findstr.exe' "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set ufwqGXTgLkMCASWld=AutoIt3.exe & Set lARJsLismygQVKnWQphbukxAJNMCNnzTF=.a3x & Set wzdTCZcyHWQBRjYmbrQgRDqvh=300
- '%WINDIR%\syswow64\extrac32.exe' /Y Producers.mpeg *.*
- '%WINDIR%\syswow64\findstr.exe' /V "phantom" Kind
- '%WINDIR%\syswow64\choice.exe' /d n /t 5
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /tn "Corners" /tr "wscript //B '%LOCALAPPDATA%\MaritimeTech Dynamics\TechHarbor.js'" /sc minute /mo 5 /F
- '%WINDIR%\syswow64\cmd.exe' /k echo [InternetShortcut] > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\TechHarbor.url" & echo URL="%LOCALAPPDATA%\MaritimeTech Dynamics\TechHarbor.js" >> "%APPDATA%\Microsoft\Win...
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Corners" /tr "wscript //B '%LOCALAPPDATA%\MaritimeTech Dynamics\TechHarbor.js'" /sc minute /mo 5 /F
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
- '%WINDIR%\syswow64\cmd.exe' /c copy Diameter.mpeg Diameter.mpeg.bat & Diameter.mpeg.bat' (with hidden window)
