Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%TEMP%\terzfardvkrs.sys'
Creates the following services
- 'WinRing0_1_2_0' %TEMP%\terzfardvkrs.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\terzfardvkrs.sys
Modifies the HOSTS file.
Network activity
Connects to
- 'ge##ert.net':443
- 'xm#####a1.nanopool.org':10343
TCP
Other
- 'ge##ert.net':443
- 'xm#####a1.nanopool.org':10343
UDP
- DNS ASK xm#####a1.nanopool.org
- DNS ASK ge##ert.net
Miscellaneous
Executes the following
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\svchost.exe'
