Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'OverlordAgent-810100e4' = '"%APPDATA%\Microsoft\DeviceSync\svchost.exe.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\agent-1790617098.tmp
- <SYSTEM32>\tasks\svchost.exe_acb4aba6
Modifies file system
Creates the following files
- %TEMP%\run8cfe.tmp.exe
- %APPDATA%\microsoft\devicesync\agent-1829667370.tmp
- %APPDATA%\microsoft\devicesync\agent-3957927048.tmp
- %APPDATA%\microsoft\devicesync\agent-1927260663.tmp
Moves the following files
- from %APPDATA%\microsoft\devicesync\agent-1829667370.tmp to %APPDATA%\microsoft\devicesync\svchost.exe.exe
- from %APPDATA%\microsoft\devicesync\agent-3957927048.tmp to %APPDATA%\microsoft\devicesync\svchost.exe.exe
- from %APPDATA%\microsoft\devicesync\agent-1927260663.tmp to %APPDATA%\microsoft\devicesync\svchost.exe.exe
Network activity
Connects to
- 'bo##.pub':4412
UDP
- DNS ASK bo##.pub
Miscellaneous
Creates and executes the following
- '%TEMP%\run8cfe.tmp.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\DeviceSync\svchost.exe.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __Instan...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\DeviceSync\svchost.exe.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __Instan...' (with hidden window)
