Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WdfLoadService] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WdfLoadService] 'ImagePath' = 'System32\drivers\WdfLoadService.sys'
Creates the following services
- 'WdfLoadService' System32\drivers\WdfLoadService.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -c "Add-MpPreference -ExclusionPath $env:APPDATA -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:TEMP -EA SilentlyContinue; Set-MpPreference -DisableRe...
Patches code
in AMSI dll
- cjafmq.exe process, Amsi.dll module
in NTDLL dll
- cjafmq.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\bt9.dll
- %TEMP%\peinj_log.txt
- <DRIVERS>\wdfloadservice.sys
- nul
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c sc stop WdfLoadService >nul 2>&1 & sc delete WdfLoadService >nul 2>&1 & sc create WdfLoadService type= kernel start= auto binPath= System32\drivers\WdfLoadService.sys
- '<SYSTEM32>\sc.exe' stop WdfLoadService
- '<SYSTEM32>\sc.exe' delete WdfLoadService
- '<SYSTEM32>\sc.exe' create WdfLoadService type= kernel start= auto binPath= System32\drivers\WdfLoadService.sys
- '<SYSTEM32>\cmd.exe' /c sc start WdfLoadService >nul 2>&1
- '<SYSTEM32>\sc.exe' start WdfLoadService
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -c "Add-MpPreference -ExclusionPath $env:APPDATA -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:TEMP -EA SilentlyContinue; Set-MpPreference -DisableRe...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdfLoadService >nul 2>&1 & sc delete WdfLoadService >nul 2>&1 & sc create WdfLoadService type= kernel start= auto binPath= System32\drivers\WdfLoadService.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc start WdfLoadService >nul 2>&1' (with hidden window)
