Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
- [<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Malware Protection Signature Update Stub' = '%PROGRAMDATA%\System Volume Information\MpSigStub.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
- [<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Security Center Elevated UI App' = '%PROGRAMDATA%\System Volume Information\wscadminui.exe'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %PROGRAMDATA%\system volume information\grouppolicy\nvrtc64_101_0.dll
- %PROGRAMDATA%\system volume information\grouppolicy\xmrig-cuda.dll
- %PROGRAMDATA%\system volume information\grouppolicy\config.json
- %PROGRAMDATA%\system volume information\codeintegrity\wudfcompanionhost.exe
- %PROGRAMDATA%\system volume information\codeintegrity\wudfhost.exe
- %PROGRAMDATA%\system volume information\codeintegrity\config.json
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %PROGRAMDATA%\system volume information\grouppolicy\nvrtc-builtins64_101.dll
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c4kib76z\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\h0pvkfxv\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5lnuzsu7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\811hqxka\desktop.ini
- %PROGRAMDATA%\system volume information\grouppolicy\uimgrbroker.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5lnuzsu7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\h0pvkfxv\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c4kib76z\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\811hqxka\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Network activity
TCP
HTTP GET requests
- http://19#.#28.127.174/b2/MpSigStub.exe
- http://19#.#28.127.174/b2/upnpcont.exe
- http://19#.#28.127.174/b2/64/c/config.json
- http://19#.#28.127.174/b2/64/c/WinRing0x64.sys
- http://19#.#28.127.174/b2/64/c/WUDFHost.exe
- http://19#.#28.127.174/b2/64/c/WUDFCompanionHost.exe
- http://19#.#28.127.174/b2/64/g/config.json
- http://19#.#28.127.174/b2/64/g/WinRing0x64.sys
- http://19#.#28.127.174/b2/64/g/xmrig-cuda.dll
- http://19#.#28.127.174/b2/64/g/nvrtc64_101_0.dll
- http://19#.#28.127.174/b2/64/g/nvrtc-builtins64_101.dll
- http://19#.#28.127.174/b2/64/g/UIMgrBroker.exe
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\system volume information\grouppolicy\uimgrbroker.exe'
- '%PROGRAMDATA%\system volume information\grouppolicy\uimgrbroker.exe' ' (with hidden window)
- '%PROGRAMDATA%\system volume information\mpsigstub.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls "%PROGRAMDATA%\System Volume Information" /deny Администраторы:(R,REA,RA) & icacls "%PROGRAMDATA%\System Volume Information" /deny Administrators:(R,REA,RA) & icacls "%PROGRAMDATA%\Sy...' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\cmd.exe' /c icacls "%PROGRAMDATA%\System Volume Information" /deny Администраторы:(R,REA,RA) & icacls "%PROGRAMDATA%\System Volume Information" /deny Administrators:(R,REA,RA) & icacls "%PROGRAMDATA%\Sy...
- '<SYSTEM32>\icacls.exe' "%PROGRAMDATA%\System Volume Information" /deny Администраторы:(R,REA,RA)
- '<SYSTEM32>\icacls.exe' "%PROGRAMDATA%\System Volume Information" /deny Administrators:(R,REA,RA)
