Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsAutHost] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WindowsAutHost] 'ImagePath' = '%ALLUSERSPROFILE%\WindowsServices\WindowsAutHost'
Creates the following services
- 'WindowsAutHost' %ALLUSERSPROFILE%\WindowsServices\WindowsAutHost
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\sppextcomobj.exe
- <SYSTEM32>\powercfg.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\slui.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\wusa.exe
- <SYSTEM32>\wbem\wmiprvse.exe
the following user processes:
- iexplore.exe
- firefox.exe
- windowsauthost
Hooks functions
in browsers
- iexplore.exe process, advapi32.dll module
- firefox.exe process, advapi32.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\dialer.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\windowsservices\windowsauthost
- %WINDIR%\temp\__psscriptpolicytest_1g4yuqbd.5tb.ps1
- %WINDIR%\temp\__psscriptpolicytest_txetfmru.b55.psm1
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-29-550.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-29-963.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-30-204.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-30-488.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-30-535.dump
- %WINDIR%\temp\__psscriptpolicytest_yuz10nov.e0c.ps1
- %WINDIR%\temp\__psscriptpolicytest_te1ika34.sn1.psm1
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-30-768.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-30-806.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-30-858.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-041.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-227.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-426.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-639.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-725.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-768.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-817.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-921.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-31-983.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-32-103.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-183.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-298.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-330.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-361.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-420.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-483.dump
- %WINDIR%\temp\content\1788-1216-powershell.exe-18-39-34-609.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\aonajadkzmbg.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_1g4yuqbd.5tb.ps1
- %WINDIR%\temp\__psscriptpolicytest_txetfmru.b55.psm1
- %WINDIR%\temp\__psscriptpolicytest_yuz10nov.e0c.ps1
- %WINDIR%\temp\__psscriptpolicytest_te1ika34.sn1.psm1
Modifies the HOSTS file.
Network activity
Connects to
- 'po##.#ashvault.pro':80
TCP
Other
- 'po##.#ashvault.pro':80
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK sl#####l3458647.site
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\windowsservices\windowsauthost'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\sc.exe' delete "WindowsAutHost"
- '<SYSTEM32>\sc.exe' create "WindowsAutHost" binpath= "%ALLUSERSPROFILE%\WindowsServices\WindowsAutHost" start= "auto"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "WindowsAutHost"
