Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\registerdeviceaccountchange\programdataupdate
- <SYSTEM32>\tasks\microsoft\windows\edp\scheduleddef
- <SYSTEM32>\tasks\microsoft\location\microsoftupdatermachinecore
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\windows\microsoft\runtimebroker.exe
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows\microsoft\runtimebroker.exe
Network activity
Connects to
- '14#.#3.134.94':406
TCP
HTTP GET requests
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\windows\microsoft\runtimebroker.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C powershell -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'" && gpupdate /force
- '<SYSTEM32>\cmd.exe' /C powershell -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'" && gpupdate /force' (with hidden window)
