Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'hcegbgh' = '"C:\hbeaegc\AutoIt3.exe" C:\hbeaegc\hcegbgh.a3x'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\is-vslgu.tmp\<File name>.tmp
- %TEMP%\is-m8k79.tmp\_isetup\_setup64.tmp
- %TEMP%\is-m8k79.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-s0ld9.tmp\<File name>.tmp
- %TEMP%\is-p4iv3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-p4iv3.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-p4iv3.tmp\is-qvnpt.tmp
- %TEMP%\is-p4iv3.tmp\is-pp826.tmp
- %APPDATA%\monitoring\is-trpmr.tmp
- %APPDATA%\monitoring\is-4armf.tmp
- %APPDATA%\monitoring\is-51udp.tmp
- %ALLUSERSPROFILE%\6kq1nhykx.a3x
- nul
- C:\hbeaegc\hcegbgh.a3x
- C:\hbeaegc\autoit3.exe
Deletes the following files
- %TEMP%\is-m8k79.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-m8k79.tmp\_isetup\_setup64.tmp
- %TEMP%\is-vslgu.tmp\<File name>.tmp
- %TEMP%\is-p4iv3.tmp\nvtelemetryapi32.dll
- %TEMP%\is-p4iv3.tmp\nvtelemetrybridge32.dll
- %TEMP%\is-p4iv3.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-p4iv3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s0ld9.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\6kq1nhykx.a3x
Moves the following files
- from %TEMP%\is-p4iv3.tmp\is-qvnpt.tmp to %TEMP%\is-p4iv3.tmp\nvtelemetryapi32.dll
- from %TEMP%\is-p4iv3.tmp\is-pp826.tmp to %TEMP%\is-p4iv3.tmp\nvtelemetrybridge32.dll
- from %APPDATA%\monitoring\is-trpmr.tmp to %APPDATA%\monitoring\scanner.exe
- from %APPDATA%\monitoring\is-4armf.tmp to %APPDATA%\monitoring\amphibola.eml
- from %APPDATA%\monitoring\is-51udp.tmp to %APPDATA%\monitoring\amphibola.pst
Miscellaneous
Creates and executes the following
- '%TEMP%\is-vslgu.tmp\<File name>.tmp' /SL5="$140180,3259580,845824,<Full path to file>"
- '%TEMP%\is-s0ld9.tmp\<File name>.tmp' /SL5="$60248,3259580,845824,<Full path to file>" /VERYSILENT
- '%APPDATA%\monitoring\scanner.exe' "%APPDATA%\Monitoring\\amphibola.eml"
- '%APPDATA%\monitoring\scanner.exe' %ALLUSERSPROFILE%\\6kQ1nhYkX.a3x
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
- '<SYSTEM32>\find.exe' /I "nswscsvc.exe"
- '<SYSTEM32>\find.exe' /I "avgui.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "sophoshealth.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && scanner.exe %ALLUSERSPROFILE%\\6kQ1nhYkX.a3x && del %ALLUSERSPROFILE%\\6kQ1nhYkX.a3x
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
- '<SYSTEM32>\find.exe' /I "avastui.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "wrsa.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "opssvc.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && scanner.exe %ALLUSERSPROFILE%\\6kQ1nhYkX.a3x && del %ALLUSERSPROFILE%\\6kQ1nhYkX.a3x' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"' (with hidden window)