Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\chcp.com
- <SYSTEM32>\dism.exe
the following user processes:
- dismhost.exe
Modifies file system
Creates the following files
- %TEMP%\8r3jn2g9.bat
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\appxprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\assocprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\cbsprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\dismcore.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\dismcoreps.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\dismhost.exe
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\dismprov.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\dmiprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\appxprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\assocprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\cbsprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\dismcore.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\dismprov.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\dmiprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\ffuprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\folderprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\genericprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\ibsprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\imagingprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\intlprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\logprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\msiprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\offlinesetupprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\osprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\provprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\setupplatformprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\smiprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\sysprepprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\transmogprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\unattendprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\vhdprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\en-us\wimprovider.dll.mui
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\ffuprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\folderprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\genericprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\ibsprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\imagingprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\intlprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\logprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\msiprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\offlinesetupprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\osprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\provprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\setupplatformprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\smiprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\sysprepprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\transmogprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\unattendprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\vhdprovider.dll
- %TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\wimprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\appxprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\assocprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\cbsprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\dismcore.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\dismcoreps.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\dismhost.exe
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\dismprov.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\dmiprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\appxprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\assocprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\cbsprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\dismcore.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\dismprov.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\dmiprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\ffuprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\folderprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\genericprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\ibsprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\imagingprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\intlprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\logprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\msiprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\offlinesetupprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\osprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\provprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\setupplatformprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\smiprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\sysprepprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\transmogprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\unattendprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\vhdprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\en-us\wimprovider.dll.mui
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\ffuprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\folderprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\genericprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\ibsprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\imagingprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\intlprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\logprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\msiprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\offlinesetupprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\osprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\provprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\setupplatformprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\smiprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\sysprepprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\transmogprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\unattendprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\vhdprovider.dll
- %TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\wimprovider.dll
Deletes following files that it created itself
- %TEMP%\8r3jn2g9.bat
Miscellaneous
Creates and executes the following
- '%TEMP%\658b644b-5c6d-4d9a-95f0-efb5e154756f\dismhost.exe' {F1CD5B5F-A474-4EBF-89B7-611719C6C42D}
- '%TEMP%\4ca80940-4780-4b28-940b-cd9867fab6ae\dismhost.exe' {DAA6ED6B-AC07-4C54-8B6F-A73B77689228}
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8R3JN2G9.bat" "<Full path to file>" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "function Set-ExecutionPolicy { param([Parameter(ValueFromRemainingArguments=$true)][object[]]$args) }; $b = Get-Content '<Current directory>\ShelIHo...
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\dism.exe' /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8R3JN2G9.bat" "<Full path to file>" "' (with hidden window)
