Technical Information
Triggers a user-defined sigma rule:
- 02d1d718-dd13-41af-989d-ea85c7fab93f
- 4281cb20-2994-4580-aa63-c8b86d019934
- 81bcb81b-5b1f-474b-b373-52c871aaa7b1
- 05b2aa93-1210-42c8-8d9a-2fcc13b284f5
- 17a1be64-8d88-40bf-b5ff-a4f7a50ebcc8
- 85ff530b-261d-48c6-a441-facaa2e81e48
- 1d61f71d-59d2-479e-9562-4ff5f4ead16b
- 970007b7-ce32-49d0-a4a4-fbef016950bd
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb] 'ImagePath' = 'cmd /c cd /d "C:\Drivers\iuRK" && start "" "C:\Drivers\iuRK\r0bqPSc6.exe"'
Creates the following services
- 'PuljuAGteGuPLjiAJjSAfJrb' cmd /c cd /d "C:\Drivers\iuRK" && start "" "C:\Drivers\iuRK\r0bqPSc6.exe"
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM r0bqPSc6.exe /T
- '%WINDIR%\syswow64\taskkill.exe' /F /IM installer.exe /T
Modifies file system
Creates the following files
- %TEMP%\is-vb8f1aul8s.tmp\<File name>.tmp
- C:\drivers\iurk\is-psuv3i5agj.tmp
- C:\drivers\iurk\is-if5xwyuk0b.tmp
- C:\drivers\iurk\is-h4gyokj0wm.tmp
- C:\drivers\iurk\is-5clu0cgmu2.tmp
- C:\drivers\iurk\is-6163fphst7.tmp
- C:\drivers\iurk\is-rcyvurrjej.tmp
- C:\drivers\74nvoebe\is-kqnzsz3ju6.tmp
- C:\drivers\74nvoebe\is-h3fxlx1bef.tmp
- C:\drivers\74nvoebe\is-88fiax5vkp.tmp
- C:\drivers\74nvoebe\is-qgszfemgqq.tmp
- C:\drivers\74nvoebe\is-7h6x4vecnz.tmp
- C:\drivers\74nvoebe\is-lqqp2zme2a.tmp
- C:\drivers\74nvoebe\is-xxyxqb0w68.tmp
- C:\drivers\74nvoebe\is-4e30u9n454.tmp
- C:\drivers\vxp12u\is-wb7cl76zc1.tmp
- %HOMEPATH%\desktop\闪连vpn.lnk
- C:\drivers\drivers.dat.0
- C:\drivers\drivers.dat
- \device\namedpipe\ntsvcs
Sets the 'hidden' attribute to the following files
- C:\drivers\74nvoebe\installer.exe
- C:\drivers\74nvoebe\od0djry.ico
- C:\drivers\74nvoebe\展示视频_01.mp4
- C:\drivers\74nvoebe\展示视频_02.mp4
- C:\drivers\74nvoebe\素材图片_01.png
- C:\drivers\74nvoebe\素材图片_02.png
- C:\drivers\74nvoebe\背景音频_01.mp3
- C:\drivers\74nvoebe\背景音频_02.mp3
- C:\drivers\iurk\b5i.etx
- C:\drivers\iurk\conference_new.dll
- C:\drivers\iurk\msvcp140.dll
- C:\drivers\iurk\r0bqpsc6.exe
- C:\drivers\iurk\vcruntime140.dll
- C:\drivers\iurk\vcruntime140_1.dll
- C:\drivers\vxp12u\7ud4pbcflih.xfdz
- C:\drivers\drivers.dat
- C:\drivers\drivers.dat.0
Deletes following files that it created itself
- %TEMP%\is-vb8f1aul8s.tmp\<File name>.tmp
Moves the following files
- from C:\drivers\iurk\is-psuv3i5agj.tmp to C:\drivers\iurk\b5i.etx
- from C:\drivers\iurk\is-if5xwyuk0b.tmp to C:\drivers\iurk\conference_new.dll
- from C:\drivers\iurk\is-h4gyokj0wm.tmp to C:\drivers\iurk\msvcp140.dll
- from C:\drivers\iurk\is-5clu0cgmu2.tmp to C:\drivers\iurk\r0bqpsc6.exe
- from C:\drivers\iurk\is-6163fphst7.tmp to C:\drivers\iurk\vcruntime140.dll
- from C:\drivers\iurk\is-rcyvurrjej.tmp to C:\drivers\iurk\vcruntime140_1.dll
- from C:\drivers\74nvoebe\is-kqnzsz3ju6.tmp to C:\drivers\74nvoebe\installer.exe
- from C:\drivers\74nvoebe\is-h3fxlx1bef.tmp to C:\drivers\74nvoebe\od0djry.ico
- from C:\drivers\74nvoebe\is-88fiax5vkp.tmp to C:\drivers\74nvoebe\展示视频_01.mp4
- from C:\drivers\74nvoebe\is-qgszfemgqq.tmp to C:\drivers\74nvoebe\展示视频_02.mp4
- from C:\drivers\74nvoebe\is-7h6x4vecnz.tmp to C:\drivers\74nvoebe\素材图片_01.png
- from C:\drivers\74nvoebe\is-lqqp2zme2a.tmp to C:\drivers\74nvoebe\素材图片_02.png
- from C:\drivers\74nvoebe\is-xxyxqb0w68.tmp to C:\drivers\74nvoebe\背景音频_01.mp3
- from C:\drivers\74nvoebe\is-4e30u9n454.tmp to C:\drivers\74nvoebe\背景音频_02.mp3
- from C:\drivers\vxp12u\is-wb7cl76zc1.tmp to C:\drivers\vxp12u\7ud4pbcflih.xfdz
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-vb8f1aul8s.tmp\<File name>.tmp' /SL5="$A02D2,119463895,969728,<Full path to file>"
- 'C:\drivers\iurk\r0bqpsc6.exe'
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"
- '<SYSTEM32>\icacls.exe' \"C:\Drivers\" /deny Users:(D)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
- '<SYSTEM32>\icacls.exe' \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
- '<SYSTEM32>\attrib.exe' C:\Drivers +s +h
- '<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D
- '<SYSTEM32>\cmd.exe' /c sc stop PuljuAGteGuPLjiAJjSAfJrb
- '<SYSTEM32>\sc.exe' stop PuljuAGteGuPLjiAJjSAfJrb
- '<SYSTEM32>\cmd.exe' /c sc delete PuljuAGteGuPLjiAJjSAfJrb
- '<SYSTEM32>\sc.exe' delete PuljuAGteGuPLjiAJjSAfJrb
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb /f
- '<SYSTEM32>\cmd.exe' /c sc create PuljuAGteGuPLjiAJjSAfJrb binPath= "cmd /c cd /d \"C:\Drivers\iuRK\" && start \"\" \"C:\Drivers\iuRK\r0bqPSc6.exe\"" start= auto
- '<SYSTEM32>\sc.exe' create PuljuAGteGuPLjiAJjSAfJrb binPath= "cmd /c cd /d \"C:\Drivers\iuRK\" && start \"\" \"C:\Drivers\iuRK\r0bqPSc6.exe\"" start= auto
- '<SYSTEM32>\sc.exe' qc PuljuAGteGuPLjiAJjSAfJrb
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb
- '<SYSTEM32>\cmd.exe' /c sc failure PuljuAGteGuPLjiAJjSAfJrb reset= 0 actions= restart/1000
- '<SYSTEM32>\sc.exe' failure PuljuAGteGuPLjiAJjSAfJrb reset= 0 actions= restart/1000
- '<SYSTEM32>\sc.exe' start MicrosoftEdgeElevationService
- '<SYSTEM32>\sc.exe' start VSS
- '%WINDIR%\syswow64\taskkill.exe' /F /IM r0bqPSc6.exe /T' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM installer.exe /T' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /deny Users:(D)"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"' (with hidden window)
- '<SYSTEM32>\attrib.exe' C:\Drivers +s +h' (with hidden window)
- '<SYSTEM32>\attrib.exe' C:\Drivers\* +s +h /S /D' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc delete PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc create PuljuAGteGuPLjiAJjSAfJrb binPath= "cmd /c cd /d \"C:\Drivers\iuRK\" && start \"\" \"C:\Drivers\iuRK\r0bqPSc6.exe\"" start= auto' (with hidden window)
- '<SYSTEM32>\sc.exe' qc PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Services\PuljuAGteGuPLjiAJjSAfJrb' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc failure PuljuAGteGuPLjiAJjSAfJrb reset= 0 actions= restart/1000' (with hidden window)
- '<SYSTEM32>\sc.exe' start MicrosoftEdgeElevationService' (with hidden window)
- '<SYSTEM32>\sc.exe' start VSS' (with hidden window)
