Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Google\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Google\Libs\WR64.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\google\libs\wr64.sys
- %APPDATA%\google\libs\g.log
- %TEMP%\xfkvozle.tmp
Network activity
Connects to
- 'po##.#ashvault.pro':80
- '94.##6.144.55':80
TCP
HTTP POST requests
- http://94.##6.144.55/api/endpoint.php
Other
- 'po##.#ashvault.pro':80
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
- '<SYSTEM32>\cmd.exe' /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "%APPDATA%\Google\Libs\g.log"
- '<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController GET Name, VideoProcessor
- '<SYSTEM32>\svchost.exe' ohigvzijowtqefia 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeunYhNB+axNGeIul6NHVs/Cv5UbvAjb23G5NyQH6GAJH5GmrzHL6KTHnw1WTaiHlYITK6mXclTp1ADmlhx5pB7/YORJ3Ufy7pq1A89W0CV5HeWn+5...
