Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\config\systemprofile\AppData\Local\Microsoft\WindowsServices' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'RuntimeBroker.exe' = '00000000'
Injects code into
the following system processes:
- <SYSTEM32>\runtimebroker.exe
Patches code
in AMSI dll
- dtbhfvw.exe process, Amsi.dll module
- runtimebroker.exe process, Amsi.dll module
in NTDLL dll
- dtbhfvw.exe process, ntdll.dll module
- runtimebroker.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %WINDIR%\temp\bd2ca7a0c766986c.tmp
Deletes following files that it created itself
- %WINDIR%\temp\bd2ca7a0c766986c.tmp
Network activity
TCP
Other
- '14#.#5.43.160':7777
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\runtimebroker.exe'
