Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio Universal Service' = '%APPDATA%\Microsoft\Protect\SecurityHealthSystray.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio Watcher Service' = '%APPDATA%\Microsoft\Protect\SecurityHealthWatcher.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath <Full path to file>
Modifies file system
Creates the following files
- %APPDATA%\microsoft\protect\securityhealthsystray.exe
- %APPDATA%\microsoft\protect\securityhealthwatcher.exe
- %TEMP%\commonfiles-temp\user\memorandum.doc
- nul
Sets the 'hidden' attribute to the following files
- <Full path to file>
- %APPDATA%\microsoft\protect\securityhealthsystray.exe
- %APPDATA%\microsoft\protect\securityhealthwatcher.exe
Network activity
Connects to
- 'ap#.#pify.org':443
- 'on####ud.pages.dev':443
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
Other
- 'ap#.#pify.org':443
- 'on####ud.pages.dev':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK on####ud.pages.dev
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\protect\securityhealthsystray.exe'
- '%APPDATA%\microsoft\protect\securityhealthwatcher.exe'
Executes the following
- '<SYSTEM32>\attrib.exe' +h +s <Full path to file>
- '<SYSTEM32>\wbem\wmic.exe' csproduct get UUID
- '<SYSTEM32>\wbem\wmic.exe' os get Caption
- '<SYSTEM32>\wbem\wmic.exe' cpu get Name
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Protect\SecurityHealthSystray.exe
- '<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Protect\SecurityHealthWatcher.exe
- '<SYSTEM32>\attrib.exe' +h +s <Full path to file>' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' csproduct get UUID' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' os get Caption' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' cpu get Name' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name' (with hidden window)
- '<SYSTEM32>\netsh.exe' wlan show profiles' (with hidden window)
- '<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Protect\SecurityHealthSystray.exe' (with hidden window)
- '<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Protect\SecurityHealthWatcher.exe' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath <Full path to file>' (with hidden window)
