Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows' = '%APPDATA%\Windows\windows.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows' = '"%APPDATA%\Windows\windows.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows.lnk
- <SYSTEM32>\tasks\windows
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\svc000d40e2.exe
- %APPDATA%\windows\windows.exe
- %LOCALAPPDATA%\microsoft\windowsservices\svchost.dat
- %LOCALAPPDATA%\nvidia\shadercache\audiodg.exe
- %LOCALAPPDATA%\nvidia\shadercache\securityhealthsystray.exe
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\x1hytoie.5wq.xml
- %LOCALAPPDATA%\nvidia\shadercache\waasmedicsvc.exe
- %LOCALAPPDATA%\nvidia\shadercache\sihost.exe
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_c2ujm4sd.bki.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_dfm0w1gx.bgw.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_f4led54o.a2s.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_qbaeabrv.lbw.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_edc1d167\login data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_249bc990\login data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_e85ca0a2\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_e85ca0a2\history-journal
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_28da262e\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_28da262e\history-journal
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_9c761917\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_cc38ebea\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_92450232.db
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_f38b2e8a.db
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_4546613d.db
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_4546613d.db-shm
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\krohjwlf.155.xml
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_134ebc10\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_66c7b078\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_b83388e3\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_756ba8e6\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_03760418\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_b91e3fcd\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_fz1qcqve.ubx.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_u34gd5ff.wyb.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_2quayspe.goz.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_lanmsrjc.kx2.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_xltc1x0a.x44.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_onqfpwwz.r1n.psm1
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windowsservices\svchost.dat
- %LOCALAPPDATA%\nvidia\shadercache\audiodg.exe
- %LOCALAPPDATA%\nvidia\shadercache\securityhealthsystray.exe
- %LOCALAPPDATA%\nvidia\shadercache\waasmedicsvc.exe
- %LOCALAPPDATA%\nvidia\shadercache\sihost.exe
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\x1hytoie.5wq.xml
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_c2ujm4sd.bki.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_dfm0w1gx.bgw.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_f4led54o.a2s.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_qbaeabrv.lbw.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_249bc990\login data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_edc1d167\login data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_28da262e\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_28da262e\history-journal
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_e85ca0a2\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_cc38ebea\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_9c761917\history
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_92450232.db
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_f38b2e8a.db
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\ffc_4546613d.db
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_66c7b078\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_b83388e3\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_134ebc10\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_03760418\web data
- <SYSTEM32>\tasks\windows
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_b91e3fcd\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\dbc_756ba8e6\web data
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\krohjwlf.155.xml
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_fz1qcqve.ubx.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_u34gd5ff.wyb.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_2quayspe.goz.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_lanmsrjc.kx2.psm1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_xltc1x0a.x44.ps1
- %LOCALAPPDATA%\microsoft\windows\shellcomponents\__psscriptpolicytest_onqfpwwz.r1n.psm1
Network activity
TCP
Other
- '45.##1.215.96':7777
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%TEMP%\svc000d40e2.exe'
- '%APPDATA%\windows\windows.exe'
- '%LOCALAPPDATA%\nvidia\shadercache\audiodg.exe'
- '%LOCALAPPDATA%\nvidia\shadercache\securityhealthsystray.exe'
- '%LOCALAPPDATA%\nvidia\shadercache\waasmedicsvc.exe'
- '%LOCALAPPDATA%\nvidia\shadercache\sihost.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Windows" /F
- '<SYSTEM32>\schtasks.exe' /Create /XML "%LOCALAPPDATA%\Microsoft\Windows\ShellComponents\x1hytoie.5wq.xml" /TN "Windows" /F
- '<SYSTEM32>\schtasks.exe' /Query /TN "Windows"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NonInteractive -NoProfile -EncodedCommand DQAKACQAbgBzACAAPQAgACcAUgBPAE8AVABcAHMAdQBiAHMAYwByAGkAcAB0AGkAbwBuACcAOwAgACQAbgAgAD0AIAAnAFcAaQBuAGQAbwB3AHMAJwANAAoAdAByAHkAIAB7ACAAZwB3AG0AaQAgAC...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NonInteractive -NoProfile -Command "(gwmi -Namespace ROOT\subscription -Class __EventFilter -Filter \"Name='Windows'\" -ErrorAction SilentlyContinue) -ne $null"
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\schtasks.exe' /Create /XML "%LOCALAPPDATA%\Microsoft\Windows\ShellComponents\krohjwlf.155.xml" /TN "Windows" /F
- '<SYSTEM32>\netsh.exe' wlan show networks
- '<SYSTEM32>\wbem\wmiapsrv.exe'
- '%TEMP%\svc000d40e2.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Windows" /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /XML "%LOCALAPPDATA%\Microsoft\Windows\ShellComponents\x1hytoie.5wq.xml" /TN "Windows" /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Query /TN "Windows"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /XML "%LOCALAPPDATA%\Microsoft\Windows\ShellComponents\krohjwlf.155.xml" /TN "Windows" /F' (with hidden window)
