Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\sc.exe' config avgwd start= disabled
- '<SYSTEM32>\sc.exe' config Avgtdix start= disabled
- '<SYSTEM32>\sc.exe' config Avggrkx86 start= disabled
- '<SYSTEM32>\sc.exe' config AntiVirSchedulerService start= disabled
- '<SYSTEM32>\alg.exe' /c rd %systemdrive%\Program Files\Vexira Antivirus /q /s
- '<SYSTEM32>\sc.exe' config mfevtp start= disabled
- '<SYSTEM32>\sc.exe' config AntiVirService start= disabled
- '<SYSTEM32>\sc.exe' config AVGIDSEH start= disabled
- '<SYSTEM32>\sc.exe' config AVGIDSDriver start= disabled
- '<SYSTEM32>\sc.exe' config AVGIDSagent start= disabled
- '<SYSTEM32>\sc.exe' config AVGIDSFilter start= disabled
- '<SYSTEM32>\sc.exe' config Avgldx86 start= disabled
- '<SYSTEM32>\sc.exe' config Avgmfx86 start= disabled
- '<SYSTEM32>\sc.exe' config AVGIDSShim start= disabled
- '<SYSTEM32>\sc.exe' /pid=2832
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\Sophos\Sophos Anti-Virus /q /s
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\Sophos\Sophos Client Firewall /q /s
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\Sophos\ /q /s
- '<SYSTEM32>\alg.exe' /pid=500
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\Malwarebytes' Anti-Malware /q /s
- '<SYSTEM32>\sc.exe' /pid=1724
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\CometBird /q /s
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\iolo\System Mechanic /q /s
- '<SYSTEM32>\net1.exe' /c rd %systemdrive%\Program Files (x86)\NortonInstaller /q /s
- '<SYSTEM32>\sc.exe' /pid=2808
- '<SYSTEM32>\sc.exe' /pid=2824
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\ArcaBit\ArcaVir /q /s
- '<SYSTEM32>\sc.exe' /c rd %systemdrive%\Program Files (x86)\SUPERAntiSpyware /q /s
- '<SYSTEM32>\sc.exe' config aswTdi start= disabled
- '<SYSTEM32>\sc.exe' delete MpsSvc
- '<SYSTEM32>\net1.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\net1.exe' stop security center
- '<SYSTEM32>\sc.exe' delete WinDefend
- '<SYSTEM32>\net1.exe' stop MsMpSvc
- '<SYSTEM32>\sc.exe' delete SharedAccess
- '<SYSTEM32>\net.exe' stop WinDefend
- '<SYSTEM32>\net.exe' stop MpsSvc
- '<SYSTEM32>\sc.exe' stop SharedAccess
- '<SYSTEM32>\net.exe' stop security center
- '<SYSTEM32>\net1.exe' stop MpsSvc
- '<SYSTEM32>\sc.exe' stop wscsvc
- '<SYSTEM32>\net.exe' stop MsMpSvc
- '<SYSTEM32>\sc.exe' config aswFsBlk start= disabled
- '<SYSTEM32>\sc.exe' config Aavmker4 start= disabled
- '<SYSTEM32>\sc.exe' delete MBAMScheduler
- '<SYSTEM32>\sc.exe' config aswMon2 start= disabled
- '<SYSTEM32>\sc.exe' config aswSP start= disabled
- '<SYSTEM32>\sc.exe' config aswSnx start= disabled
- '<SYSTEM32>\sc.exe' config aswRdr start= disabled
- '<SYSTEM32>\sc.exe' delete wscsvc
- '<SYSTEM32>\sc.exe' delete MsMpSvc
- '<SYSTEM32>\sc.exe' delete security center
- '<SYSTEM32>\sc.exe' stop MBAMService
- '<SYSTEM32>\sc.exe' stop MBAMScheduler
- '<SYSTEM32>\sc.exe' config MBAMService start= disabled
- '<SYSTEM32>\sc.exe' delete MBAMService
Injects code into
the following system processes:
- <SYSTEM32>\sc.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\net.exe
- <SYSTEM32>\alg.exe
- <SYSTEM32>\net1.exe
the following user processes:
- ZONEALARM.EXE
- AVGCTRL.EXE
- ashAvast.exe
- AVP.EXE
- avgcc.exe
Terminates or attempts to terminate
the following user processes:
- NAVAPW32.EXE
- AVGCC32.EXE
- AVPCC.EXE
- AVPM.EXE
- AVP.COM
- ash.exe
- ashAvSrv.exe
- nod.exe
- nod32.exe
- AVGCTRL.EXE
- fsavgui.exe
- fsav.exe
- AVP.EXE
- bdagent.exe
- fsav32.exe
- AVP32.EXE
- ZONEALARM.EXE
- avgcc.exe
- ashAvast.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: 'RegMonClass' WindowName: '(null)'
- ClassName: 'FileMonClass' WindowName: '(null)'
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Licenses\00A263FCBCA348CDB.Lic
- %ALLUSERSPROFILE%\Application Data\TEMP\RAIDTest
