Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SupportAgent' = '<Full path to file>'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SupportAgent' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\supportagent
- <SYSTEM32>\tasks\supportagentboot
- %APPDATA%\microsoft\windows\start menu\programs\startup\supportagent.lnk
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\SupportAgent] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\SupportAgent] 'ImagePath' = '<Full path to file>'
Creates the following services
- 'SupportAgent' <Full path to file>
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath '<Full path to file>';Add-MpPreference -ExclusionPath '<Current directory>';Add-MpPrefere...
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\supportagent\logs\agent.log
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\supportagent.lnk
Network activity
Connects to
- '31.##.184.145':8000
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute '<Full path to file>';$t = New-ScheduledTaskTrigger -AtLogOn -User 'user';$s = New-ScheduledTaskSettingsSet -Hidden -AllowSta...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute '<Full path to file>';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatte...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = '<Ful...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath...
- '<SYSTEM32>\sc.exe' create SupportAgent binPath= "<Full path to file>" start= auto DisplayName= "Support Agent"
- '<SYSTEM32>\sc.exe' description SupportAgent "Support Agent remote management service"
- '<SYSTEM32>\sc.exe' failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';Add-MpPreference -ExclusionPath '<Full path to file>';Add-MpPreference -ExclusionPath '<Current directory>';Add-MpPrefere...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute '<Full path to file>';$t = New-ScheduledTaskTrigger -AtLogOn -User 'user';$s = New-ScheduledTaskSettingsSet -Hidden -AllowSta...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute '<Full path to file>';$t = New-ScheduledTaskTrigger -AtStartup;$s = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatte...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath = '<Ful...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell;$s = $ws.CreateShortcut('%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\SupportAgent.lnk');$s.TargetPath...' (with hidden window)
- '<SYSTEM32>\sc.exe' create SupportAgent binPath= "<Full path to file>" start= auto DisplayName= "Support Agent"' (with hidden window)
- '<SYSTEM32>\sc.exe' description SupportAgent "Support Agent remote management service"' (with hidden window)
- '<SYSTEM32>\sc.exe' failure SupportAgent reset= 60 actions= restart/5000/restart/10000/restart/30000' (with hidden window)
