Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinTweaks] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinTweaks] 'ImagePath' = '"%ALLUSERSPROFILE%\WinTweaks\tweaks.exe" /service'
Creates the following services
- 'WinTweaks' %ALLUSERSPROFILE%\WinTweaks weaks.exe" /servic
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\wintweaks\tweaks.exe
- %WINDIR%\temp\__psscriptpolicytest_2wdvtoff.mhj.ps1
- %WINDIR%\temp\__psscriptpolicytest_xkgkuro0.bnd.psm1
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-20-886.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-21-294.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-21-514.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-21-761.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-21-830.dump
- %WINDIR%\temp\__psscriptpolicytest_v5d12szs.4bb.ps1
- %WINDIR%\temp\__psscriptpolicytest_2yxfoj32.d0g.psm1
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-22-368.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-22-415.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-22-500.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-22-672.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-23-160.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-23-657.dump
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\appxprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\appxprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\assocprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\assocprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\cbsprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\cbsprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\dismcore.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\dismcore.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\dismcoreps.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\dismcoreps.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\dismhost.exe
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\dismhost.exe
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\dismprov.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\dismprov.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\dmiprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\dmiprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\appxprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\appxprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\assocprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\assocprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\cbsprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\dismcore.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\cbsprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\dismcore.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\dismprov.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\dismprov.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\dmiprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\dmiprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\ffuprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\ffuprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\folderprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\folderprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\genericprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\genericprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\ibsprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\ibsprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\imagingprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\imagingprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\intlprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\intlprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\logprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\logprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\msiprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\msiprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\offlinesetupprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\offlinesetupprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\osprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\osprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\provprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\provprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\setupplatformprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\setupplatformprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\smiprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\smiprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\sysprepprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\sysprepprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\transmogprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\transmogprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\unattendprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\unattendprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\vhdprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\vhdprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\en-us\wimprovider.dll.mui
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\en-us\wimprovider.dll.mui
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\ffuprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\ffuprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\folderprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\folderprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\genericprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\genericprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\ibsprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\ibsprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\imagingprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\imagingprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\intlprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\intlprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\logprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\logprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\msiprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\msiprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\offlinesetupprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\offlinesetupprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\osprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\osprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\provprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\provprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\setupplatformprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\setupplatformprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\smiprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\smiprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\sysprepprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\sysprepprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\transmogprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\transmogprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\unattendprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\unattendprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\vhdprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\vhdprovider.dll
- %WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\wimprovider.dll
- %TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\wimprovider.dll
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-44-565.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-45-909.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-46-026.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-46-064.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-46-196.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-46-259.dump
- %WINDIR%\temp\content\3824-1036-powershell.exe-09-11-46-343.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_2wdvtoff.mhj.ps1
- %WINDIR%\temp\__psscriptpolicytest_xkgkuro0.bnd.psm1
- %WINDIR%\temp\__psscriptpolicytest_v5d12szs.4bb.ps1
- %WINDIR%\temp\__psscriptpolicytest_2yxfoj32.d0g.psm1
Network activity
Connects to
- '19#.#33.113.142':8090
TCP
HTTP POST requests
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\wintweaks\tweaks.exe' /service
- '%WINDIR%\temp\ab94f54d-f862-408b-a4a3-40b683735ba4\dismhost.exe' {F061F655-9346-4591-8DEE-671F6869FB09}
- '%TEMP%\00590c0b-92ea-47c8-9b72-8cc6398b0082\dismhost.exe' {CBCD6C40-5DB5-4016-8806-9690ED14B6CA}
Executes the following
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
- '<SYSTEM32>\powercfg.exe' /hibernate off
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Set-WindowsReservedStorageState -State Disabled"
- '<SYSTEM32>\schtasks.exe' /Delete /TN WinTweaksAutoApply /F
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /hibernate off' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Set-WindowsReservedStorageState -State Disabled"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Delete /TN WinTweaksAutoApply /F' (with hidden window)
