Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoftantimalware.exe
Modifies file system
Creates the following files
- %TEMP%\_mei23202\vcruntime140.dll
- %TEMP%\_mei22442\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei22442\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei22442\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei22442\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei22442\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei22442\_ctypes.pyd
- %TEMP%\_mei22442\_decimal.pyd
- %TEMP%\_mei22442\_hashlib.pyd
- %TEMP%\_mei22442\_lzma.pyd
- %TEMP%\_mei22442\_queue.pyd
- %TEMP%\_mei22442\_bz2.pyd
- %TEMP%\_mei22442\_socket.pyd
- %TEMP%\_mei22442\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei22442\_ssl.pyd
- %TEMP%\_mei22442\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei22442\ucrtbase.dll
- %TEMP%\_mei22442\unicodedata.pyd
- %TEMP%\_mei22442\win32api.pyd
- %TEMP%\_mei22442\win32evtlog.pyd
- %TEMP%\_mei22442\win32wnet.pyd
- %TEMP%\_mei22442\base_library.zip
- %TEMP%\_mei22442\certifi\cacert.pem
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\authors.rst
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\installer
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\license
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\license.apache
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\license.bsd
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\license.psf
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\metadata
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\record
- %TEMP%\_mei22442\select.pyd
- %TEMP%\_mei22442\python37.dll
- %TEMP%\_mei22442\pywintypes37.dll
- %TEMP%\_mei22442\pyexpat.pyd
- %TEMP%\_mei22442\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei22442\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei22442\client_a.exe.manifest
- %TEMP%\_mei22442\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei22442\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei22442\libcrypto-1_1-x64.dll
- %TEMP%\_mei22442\libssl-1_1-x64.dll
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\wheel
- %TEMP%\_mei22442\vcruntime140.dll
- C:\wing\mam.exe
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\top_level.txt
- %TEMP%\_mei23202\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei23202\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei23202\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei23202\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei23202\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei23202\_ctypes.pyd
- %TEMP%\_mei23202\_decimal.pyd
- %TEMP%\_mei23202\_hashlib.pyd
- %TEMP%\_mei23202\_lzma.pyd
- %TEMP%\_mei23202\_queue.pyd
- %TEMP%\_mei23202\_bz2.pyd
- %TEMP%\_mei23202\_socket.pyd
- %TEMP%\_mei23202\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei23202\_ssl.pyd
- %TEMP%\_mei23202\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei23202\ucrtbase.dll
- %TEMP%\_mei23202\unicodedata.pyd
- %TEMP%\_mei23202\win32api.pyd
- %TEMP%\_mei23202\win32evtlog.pyd
- %TEMP%\_mei23202\win32wnet.pyd
- %TEMP%\_mei23202\base_library.zip
- %TEMP%\_mei23202\certifi\cacert.pem
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\authors.rst
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\installer
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\license
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\license.apache
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\license.bsd
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\license.psf
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\metadata
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\record
- %TEMP%\_mei23202\setup.exe.manifest
- %TEMP%\_mei23202\pywintypes37.dll
- %TEMP%\_mei23202\select.pyd
- %TEMP%\_mei23202\python37.dll
- %TEMP%\_mei23202\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei23202\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei23202\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei23202\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei23202\libcrypto-1_1-x64.dll
- %TEMP%\_mei23202\libssl-1_1-x64.dll
- %TEMP%\_mei23202\pyexpat.pyd
- %TEMP%\_mei23202\cryptography-2.7-py3.7.egg-info\wheel
- %TEMP%\_mei22442\cryptography-2.7-py3.7.egg-info\top_level.txt
Network activity
TCP
- 'drive.google.com':443
- 'do#########ocs.googleusercontent.com':443
- 'it######ing.herokuapp.com':443
UDP
- DNS ASK drive.google.com
- DNS ASK do#########ocs.googleusercontent.com
- DNS ASK it######ing.herokuapp.com
Miscellaneous
Creates and executes the following
- 'C:\wing\mam.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c cd C:\ && mkdir Wing
- '<SYSTEM32>\cmd.exe' /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Wing'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Wing'
- '<SYSTEM32>\cmd.exe' /c powershell -Command Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftAntiMalware.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftAntiMalware.exe'
- '<SYSTEM32>\cmd.exe' /c mkdir "C:/Wing"
- '<SYSTEM32>\cmd.exe' /c start C:/Wing/MAM.exe
- '<SYSTEM32>\cmd.exe' /c start init.exe
