Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CoreWorker_LHzZTFjXlgcUzKs' = '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_LHzZTFjXlgcUzKs.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CoreWorker_LHzZTFjXlgcUzKs' = '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_LHzZTFjXlgcUzKs.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows repair.lnk
- <SYSTEM32>\tasks\coreworker_lhzztfjxlgcuzks-1164
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"
Patches code
in dll
- zsrrbv.exe process, KERNEL32.dll module
- zsrrbv.exe process, KERNELBASE.dll module
- zsrrbv.exe process, ADVAPI32.dll module
- zsrrbv.exe process, USER32.dll module
in AMSI dll
- zsrrbv.exe process, Amsi.dll module
in NTDLL dll
- zsrrbv.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\0rbzpvza.b0v\crashpad\settings.dat
- %TEMP%\0rbzpvza.b0v\crashpad\throttle_store.dat
- %TEMP%\0rbzpvza.b0v\crashpadmetrics-active.pma
- %TEMP%\0rbzpvza.b0v\browsermetrics\browsermetrics-6a36e6b1-1030.pma
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\index
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_0
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_1
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_2
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_3
- %TEMP%\0rbzpvza.b0v\last version
- %TEMP%\0rbzpvza.b0v\a4571066-79e8-4158-9404-16b6ef161957.tmp
- %TEMP%\0rbzpvza.b0v\7f2298da-56af-4607-942a-e2e7e702ab2a.tmp
- %TEMP%\0rbzpvza.b0v\browsermetrics\browsermetrics-6a36e6b6-1170.pma
- %TEMP%\0rbzpvza.b0v\173375d3-79a0-4f1b-a7b7-73be46124061.tmp
- %TEMP%\0rbzpvza.b0v\4a3102d9-624f-4d47-9b3b-720132968628.tmp
- %LOCALAPPDATA%\mpdefendercorefolder\coreworker_lhzztfjxlgcuzks.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\mpdefendercorefolder\coreworker_lhzztfjxlgcuzks.exe
Deletes following files that it created itself
- %TEMP%\0rbzpvza.b0v\browsermetrics\browsermetrics-6a36e6b1-1030.pma
- %TEMP%\0rbzpvza.b0v\browsermetrics\browsermetrics-6a36e6b6-1170.pma
- %TEMP%\0rbzpvza.b0v\crashpad\settings.dat
- %TEMP%\0rbzpvza.b0v\crashpad\throttle_store.dat
- %TEMP%\0rbzpvza.b0v\crashpadmetrics.pma
- %TEMP%\0rbzpvza.b0v\last version
- %TEMP%\0rbzpvza.b0v\local state
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_0
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_1
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_2
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\data_3
- %TEMP%\0rbzpvza.b0v\shadercache\gpucache\index
Moves the following files
- from %TEMP%\0rbzpvza.b0v\a4571066-79e8-4158-9404-16b6ef161957.tmp to %TEMP%\0rbzpvza.b0v\local state
- from %TEMP%\0rbzpvza.b0v\crashpadmetrics-active.pma to %TEMP%\0rbzpvza.b0v\crashpadmetrics.pma
Substitutes the following files
- %TEMP%\0rbzpvza.b0v\crashpadmetrics-active.pma
Network activity
Connects to
- '15#.#94.99.166':63973
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/json/
Other
- '15#.#94.99.166':63973
UDP
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\0rbzpvza.b0v'
Creates and executes the following
- '%LOCALAPPDATA%\mpdefendercorefolder\coreworker_lhzztfjxlgcuzks.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_LHzZTFjXlgcUzKs.exe...
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\0rbzpvza.b0v" --app=http://127.0.0.1:49698
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\0rbzpvza.b0v" --app=http://127.0.0.1:49698 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '<SYSTEM32>\cmd.exe' /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%TEMP%\0rbzpvza.b0v" --app=http://127.0.0.1:49698 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_LHzZTFjXlgcUzKs.exe...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"' (with hidden window)
