Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdgeUpdateTaskUser' = '"<SYSTEM32>\cmd.exe" /c "if exist "%HOMEPATH%\appi\appi\pythonw.exe" start "" /B "%HOMEPATH%\appi\appi\pyth...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDrive Reporting Task' = '"<SYSTEM32>\cmd.exe" /c "if exist "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\pythonw.exe" start "" /B "%LOCA...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Compatibility Appraiser' = '"<SYSTEM32>\cmd.exe" /c "if exist "%LOCALAPPDATA%\Microsoft\Windows\Caches\pythonw.exe" start "" /B "...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Consolidator' = '"<SYSTEM32>\cmd.exe" /c "if exist "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\pythonw.exe" start "" /B "%APPDAT...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Telemetry Service' = '"<SYSTEM32>\cmd.exe" /c "if exist "%APPDATA%\Microsoft\Windows\Templates\pythonw.exe" start "" /B "%APPDATA%\...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'System Diagnostics Handler' = '"<SYSTEM32>\cmd.exe" /c "if exist "C:\$WinREAgent\pythonw.exe" start "" /B "C:\$WinREAgent\pythonw.exe" "C:\...
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftedgeupdatetaskuser_watch
Malicious functions
Patches code
in AMSI dll
- pythonw.exe process, Amsi.dll module
in NTDLL dll
- pythonw.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %HOMEPATH%\appi\appi\.gname
- %HOMEPATH%\appi\appi\.sname
- %HOMEPATH%\appi\appi\guard.pyd
- %HOMEPATH%\appi\appi\guardian.pyc
- %HOMEPATH%\appi\appi\libffi-7.dll
- %HOMEPATH%\appi\appi\python.cat
- %HOMEPATH%\appi\appi\python3.dll
- %HOMEPATH%\appi\appi\python39.dll
- %HOMEPATH%\appi\appi\python39.zip
- %HOMEPATH%\appi\appi\python39._pth
- %HOMEPATH%\appi\appi\pythonw.exe
- %HOMEPATH%\appi\appi\select.pyd
- %HOMEPATH%\appi\appi\svchost.pyc
- %HOMEPATH%\appi\appi\test.py
- %HOMEPATH%\appi\appi\vcruntime140.dll
- %HOMEPATH%\appi\appi\vcruntime140_1.dll
- %HOMEPATH%\appi\appi\watchdog.py
- %HOMEPATH%\appi\appi\_ctypes.pyd
- %HOMEPATH%\appi\appi\_hashlib.pyd
- %HOMEPATH%\appi\appi\_lzma.pyd
- %HOMEPATH%\appi\appi\_multiprocessing.pyd
- %HOMEPATH%\appi\appi\_socket.pyd
- %HOMEPATH%\appi\appi\_ssl.pyd
- %HOMEPATH%\appi\appi\_uuid.pyd
- %TEMP%\0lq638wc
- %TEMP%\.payload_main.pid
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\.gname
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\.sname
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\guard.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\guardian.pyc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\libffi-7.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\python.cat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\python3.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\python39.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\python39.zip
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\python39._pth
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\pythonw.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\select.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\svchost.pyc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\test.py
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\vcruntime140.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\vcruntime140_1.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\watchdog.py
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_ctypes.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_hashlib.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_lzma.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_multiprocessing.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_socket.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_ssl.pyd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\_uuid.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\.gname
- %LOCALAPPDATA%\microsoft\windows\caches\.sname
- %LOCALAPPDATA%\microsoft\windows\caches\guard.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\guardian.pyc
- %LOCALAPPDATA%\microsoft\windows\caches\libffi-7.dll
- %LOCALAPPDATA%\microsoft\windows\caches\python.cat
- %LOCALAPPDATA%\microsoft\windows\caches\python3.dll
- %LOCALAPPDATA%\microsoft\windows\caches\python39.dll
- %LOCALAPPDATA%\microsoft\windows\caches\python39.zip
- %LOCALAPPDATA%\microsoft\windows\caches\python39._pth
- %LOCALAPPDATA%\microsoft\windows\caches\pythonw.exe
- %LOCALAPPDATA%\microsoft\windows\caches\select.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\svchost.pyc
- %LOCALAPPDATA%\microsoft\windows\caches\test.py
- %LOCALAPPDATA%\microsoft\windows\caches\vcruntime140.dll
- %LOCALAPPDATA%\microsoft\windows\caches\vcruntime140_1.dll
- %LOCALAPPDATA%\microsoft\windows\caches\watchdog.py
- %LOCALAPPDATA%\microsoft\windows\caches\_ctypes.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\_hashlib.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\_lzma.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\_multiprocessing.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\_socket.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\_ssl.pyd
- %LOCALAPPDATA%\microsoft\windows\caches\_uuid.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\.gname
- %APPDATA%\microsoft\windows\recent\customdestinations\.sname
- %APPDATA%\microsoft\windows\recent\customdestinations\guard.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\guardian.pyc
- %APPDATA%\microsoft\windows\recent\customdestinations\libffi-7.dll
- %APPDATA%\microsoft\windows\recent\customdestinations\python.cat
- %APPDATA%\microsoft\windows\recent\customdestinations\python3.dll
- %APPDATA%\microsoft\windows\recent\customdestinations\python39.dll
- %APPDATA%\microsoft\windows\recent\customdestinations\python39.zip
- %APPDATA%\microsoft\windows\recent\customdestinations\python39._pth
- %APPDATA%\microsoft\windows\recent\customdestinations\pythonw.exe
- %APPDATA%\microsoft\windows\recent\customdestinations\select.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\svchost.pyc
- %APPDATA%\microsoft\windows\recent\customdestinations\test.py
- %APPDATA%\microsoft\windows\recent\customdestinations\vcruntime140.dll
- %APPDATA%\microsoft\windows\recent\customdestinations\vcruntime140_1.dll
- %APPDATA%\microsoft\windows\recent\customdestinations\watchdog.py
- %APPDATA%\microsoft\windows\recent\customdestinations\_ctypes.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\_hashlib.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\_lzma.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\_multiprocessing.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\_socket.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\_ssl.pyd
- %APPDATA%\microsoft\windows\recent\customdestinations\_uuid.pyd
- %APPDATA%\microsoft\windows\templates\.gname
- %APPDATA%\microsoft\windows\templates\.sname
- %APPDATA%\microsoft\windows\templates\guard.pyd
- %APPDATA%\microsoft\windows\templates\guardian.pyc
- %APPDATA%\microsoft\windows\templates\libffi-7.dll
- %APPDATA%\microsoft\windows\templates\python.cat
- %APPDATA%\microsoft\windows\templates\python3.dll
- %APPDATA%\microsoft\windows\templates\python39.dll
- %APPDATA%\microsoft\windows\templates\python39.zip
- %APPDATA%\microsoft\windows\templates\python39._pth
- %APPDATA%\microsoft\windows\templates\pythonw.exe
- %APPDATA%\microsoft\windows\templates\select.pyd
- %APPDATA%\microsoft\windows\templates\svchost.pyc
- %APPDATA%\microsoft\windows\templates\test.py
- %APPDATA%\microsoft\windows\templates\vcruntime140.dll
- %APPDATA%\microsoft\windows\templates\vcruntime140_1.dll
- %APPDATA%\microsoft\windows\templates\watchdog.py
- %APPDATA%\microsoft\windows\templates\_ctypes.pyd
- %APPDATA%\microsoft\windows\templates\_hashlib.pyd
- %APPDATA%\microsoft\windows\templates\_lzma.pyd
- %APPDATA%\microsoft\windows\templates\_multiprocessing.pyd
- %APPDATA%\microsoft\windows\templates\_socket.pyd
- %APPDATA%\microsoft\windows\templates\_ssl.pyd
- %APPDATA%\microsoft\windows\templates\_uuid.pyd
- C:\$winreagent\.gname
- C:\$winreagent\.sname
- C:\$winreagent\guard.pyd
- C:\$winreagent\guardian.pyc
- C:\$winreagent\libffi-7.dll
- C:\$winreagent\python.cat
- C:\$winreagent\python3.dll
- C:\$winreagent\python39.dll
- C:\$winreagent\python39.zip
- C:\$winreagent\python39._pth
- C:\$winreagent\pythonw.exe
- C:\$winreagent\select.pyd
- C:\$winreagent\svchost.pyc
- C:\$winreagent\test.py
- C:\$winreagent\vcruntime140.dll
- C:\$winreagent\vcruntime140_1.dll
- C:\$winreagent\watchdog.py
- C:\$winreagent\_ctypes.pyd
- C:\$winreagent\_hashlib.pyd
- C:\$winreagent\_lzma.pyd
- C:\$winreagent\_multiprocessing.pyd
- C:\$winreagent\_socket.pyd
- C:\$winreagent\_ssl.pyd
- C:\$winreagent\_uuid.pyd
- C:\perflogs\admin\.gname
- C:\perflogs\admin\.sname
- C:\perflogs\admin\guard.pyd
- C:\perflogs\admin\guardian.pyc
- C:\perflogs\admin\libffi-7.dll
- C:\perflogs\admin\python.cat
- C:\perflogs\admin\python3.dll
- C:\perflogs\admin\python39.dll
- C:\perflogs\admin\python39.zip
- C:\perflogs\admin\python39._pth
- C:\perflogs\admin\pythonw.exe
- C:\perflogs\admin\select.pyd
- C:\perflogs\admin\svchost.pyc
- C:\perflogs\admin\test.py
- C:\perflogs\admin\vcruntime140.dll
- C:\perflogs\admin\vcruntime140_1.dll
- C:\perflogs\admin\watchdog.py
- C:\perflogs\admin\_ctypes.pyd
- C:\perflogs\admin\_hashlib.pyd
- C:\perflogs\admin\_lzma.pyd
- C:\perflogs\admin\_multiprocessing.pyd
- C:\perflogs\admin\_socket.pyd
- C:\perflogs\admin\_ssl.pyd
- C:\perflogs\admin\_uuid.pyd
- %TEMP%\tmps9f5x2e3.xml
- %HOMEPATH%\appi\appi\shell_ext.sct
- %TEMP%\swrl0cwk
- %TEMP%\~0b66070f_g1.tmp
- %TEMP%\~0b66070f_m.tmp
- %TEMP%\~0b66070f_r.tmp.ts
- %TEMP%\~0b66070f_g2.tmp
- %TEMP%\vb3tor1m
- %TEMP%\cyai3eke
- %TEMP%\zgf71d4t
- %TEMP%\z01mm_93
- %TEMP%\_cu0109i
- %TEMP%\h89fduze
- %TEMP%\9_sndnku
- %TEMP%\mouquw81
- %TEMP%\agh85pbf
- %TEMP%\6utxt52l
- %TEMP%\fl0pgg3g
- %TEMP%\rzjenbfk
- %TEMP%\d0uu1v08
- %TEMP%\mrnucgrd
- %TEMP%\7wot3d8_
- %TEMP%\im3q8_5h
- %TEMP%\zoga6xsx
Deletes following files that it created itself
- %TEMP%\0lq638wc
- %TEMP%\tmps9f5x2e3.xml
- %TEMP%\swrl0cwk
- %TEMP%\vb3tor1m
- %TEMP%\cyai3eke
- %TEMP%\zgf71d4t
- %TEMP%\z01mm_93
- %TEMP%\_cu0109i
- %TEMP%\h89fduze
- %TEMP%\9_sndnku
- %TEMP%\mouquw81
- %TEMP%\agh85pbf
- %TEMP%\6utxt52l
- %TEMP%\fl0pgg3g
- %TEMP%\rzjenbfk
- %TEMP%\d0uu1v08
- %TEMP%\mrnucgrd
- %TEMP%\7wot3d8_
- %TEMP%\im3q8_5h
- %TEMP%\zoga6xsx
Network activity
Connects to
- 'yo###je.shop':8848
TCP
Other
- 'yo###je.shop':8848
UDP
- DNS ASK yo###je.shop
Miscellaneous
Searches for the following windows
- ClassName: 'Edit' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\appi\appi\pythonw.exe' appi\svchost.pyc
- '%HOMEPATH%\appi\appi\pythonw.exe' %HOMEPATH%\appi\appi\guardian.pyc
- '%HOMEPATH%\appi\appi\pythonw.exe' %HOMEPATH%\appi\appi\svchost.pyc
Executes the following
- '<SYSTEM32>\schtasks.exe' /Delete /TN MicrosoftEdgeUpdateTaskUser_watch /F
- '<SYSTEM32>\schtasks.exe' /Create /TN MicrosoftEdgeUpdateTaskUser_watch /XML %TEMP%\tmps9f5x2e3.xml /F
