Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\itucuuw] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\itucuuw] 'ImagePath' = '<SYSTEM32>\<File name>.exe /service'
Creates the following services
- '<File name>' <SYSTEM32>\<File name>.exe /service
Malicious functions
Patches code
in AMSI dll
- itucuuw.exe process, Amsi.dll module
in NTDLL dll
- itucuuw.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %WINDIR%\syswow64\<File name>.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\<File name>.exe
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\<File name>.exe'
- '%WINDIR%\syswow64\<File name>.exe' /service
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop <File name>
- '%WINDIR%\syswow64\sc.exe' delete <File name>
- '%WINDIR%\syswow64\sc.exe' create <File name> binPath= "<SYSTEM32>\<File name>.exe /service" type= own start= auto
- '%WINDIR%\syswow64\sc.exe' description <File name> "Mason Stable Service (Single Instance)"
- '%WINDIR%\syswow64\sc.exe' failure <File name> reset= 3600 actions= restart/10000
- '%WINDIR%\syswow64\sc.exe' start <File name>
