Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\KTTNXFKO] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\KTTNXFKO] 'ImagePath' = '%ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\hoouyqjqqvyx.sys'
Creates the following services
- 'KTTNXFKO' %ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\hoouyqjqqvyx.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- <PATH_SAMPLE>_packed.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %APPDATA%\microsoft\telemetry\win_services_host.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>_packed.exe.log
- %ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe
- %WINDIR%\temp\__psscriptpolicytest_anbljsnp.z32.ps1
- %WINDIR%\temp\__psscriptpolicytest_r504tyrn.4zz.psm1
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-16-331.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-16-675.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-16-846.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-17-188.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-17-266.dump
- %WINDIR%\temp\__psscriptpolicytest_uruyeady.wjq.ps1
- %WINDIR%\temp\__psscriptpolicytest_1rpptvbs.nyd.psm1
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-17-640.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-17-726.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-18-315.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-18-492.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-18-737.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-18-894.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-163.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-267.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-366.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-454.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-508.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-560.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-19-616.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-20-690.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-20-805.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-21-026.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-21-059.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-21-062.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-21-282.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-21-338.dump
- %WINDIR%\temp\content\5372-5836-powershell.exe-22-54-21-502.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\hoouyqjqqvyx.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_anbljsnp.z32.ps1
- %WINDIR%\temp\__psscriptpolicytest_r504tyrn.4zz.psm1
- %WINDIR%\temp\__psscriptpolicytest_uruyeady.wjq.ps1
- %WINDIR%\temp\__psscriptpolicytest_1rpptvbs.nyd.psm1
Network activity
Connects to
- 'gi##.###hubusercontent.com':443
- 'x1.#.lencr.org':80
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'po##.#ashvault.pro':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'gi##.###hubusercontent.com':443
- 'gi##ub.com':443
- 'po##.#ashvault.pro':443
UDP
- DNS ASK gi##.###hubusercontent.com
- DNS ASK x1.#.lencr.org
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '<PATH_SAMPLE>_packed.exe'
- '%APPDATA%\microsoft\telemetry\win_services_host.exe'
- '%ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' delete "KTTNXFKO"
- '<SYSTEM32>\sc.exe' create "KTTNXFKO" binpath= "%ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe" start= "auto"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "KTTNXFKO"
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\svchost.exe'
