Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"
Patches code
in AMSI dll
- fyyqyw.exe process, Amsi.dll module
in NTDLL dll
- fyyqyw.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\fsmuncsr.exe
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\fsmuncsr.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
- '<SYSTEM32>\cmd.exe' /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"
- '<SYSTEM32>\cmd.exe' /C gpupdate /force
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\cmd.exe' /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','%ALLUSERSPROFILE%\Windows\Microsoft','%ALLUSERSPROFILE%\Microsoft\Windows'"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C gpupdate /force' (with hidden window)
- '%ALLUSERSPROFILE%\fsmuncsr.exe' ' (with hidden window)
