Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\desktop windows manager adapter for microsoft windows
- <SYSTEM32>\tasks\virtual disk manager adapter for microsoft windows
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Wwanip] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Wwanip] 'ImagePath' = 'C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\sysdll.exe'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '<SYSTEM32>\WinRing0x64.sys'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %PROGRAMDATA%\microsoft\windows\intelx86_driver\iv.exe
- %ProgramFiles(x86)%\shaearn\shaearn\setup_x86.exe
- %ProgramFiles(x86)%\shaearn\shaearn\shaearn.exe
- %ProgramFiles(x86)%\shaearn\shaearn\uninstall.exe
- %ProgramFiles(x86)%\shaearn\shaearn\uninstall.ini
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\sysdll.exe
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\vxml.xml
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\ixml.xml
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\sc.md
- %PROGRAMDATA%\microsoft\windows\intelx86_driver\service.exe
- %ProgramFiles(x86)%\microsoft corporation\microsoft visual c++ 2013 redistributable (x86) - 19.1.30551\uninstall.exe
- %ProgramFiles(x86)%\microsoft corporation\microsoft visual c++ 2013 redistributable (x86) - 19.1.30551\uninstall.ini
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\intel_adapter.exe
- %PROGRAMDATA%\microsoft\windows\intelx86_driver\intel_vga.exe
Sets the 'hidden' attribute to the following files
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\sc.md
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\vxml.xml
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\ixml.xml
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\sysdll.exe
- C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\intel_adapter.exe
- %PROGRAMDATA%\microsoft\windows\intelx86_driver\intel_vga.exe
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
Substitutes the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Network activity
TCP
HTTP GET requests
- http://www.xs##n.cf/ssr-download/intel.exe
UDP
- DNS ASK gu##.##neroocean.stream
- DNS ASK xs##n.cf
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\shaearn\shaearn\shaearn.exe'
- '%ProgramFiles(x86)%\shaearn\shaearn\setup_x86.exe'
- '%PROGRAMDATA%\microsoft\windows\intelx86_driver\iv.exe'
- 'C:\users\system\appdata\roaming\intel\graphics_driver\graphics_driver\sysdll.exe'
- '%ProgramFiles(x86)%\shaearn\shaearn\setup_x86.exe' ' (with hidden window)
- '%PROGRAMDATA%\microsoft\windows\intelx86_driver\iv.exe' ' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop Wwanip' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete Wwanip' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /xml "C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\vxml.xml" /tn "Desktop Windows Manager Adapter For Microsoft Windows" /ru "system"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /xml "C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\ixml.xml" /tn "Virtual Disk Manager Adapter For Microsoft Windows" /ru "system"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create Wwanip binPath= "C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\sysdll.exe" start= auto' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start Wwanip' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop Wwanip
- '%WINDIR%\syswow64\sc.exe' delete Wwanip
- '%WINDIR%\syswow64\schtasks.exe' /create /xml "C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\vxml.xml" /tn "Desktop Windows Manager Adapter For Microsoft Windows" /ru "system"
- '%WINDIR%\syswow64\schtasks.exe' /create /xml "C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\ixml.xml" /tn "Virtual Disk Manager Adapter For Microsoft Windows" /ru "system"
- '%WINDIR%\syswow64\sc.exe' create Wwanip binPath= "C:\Users\SYSTEM\AppData\Roaming\Intel\Graphics_driver\Graphics_driver\sysdll.exe" start= auto
- '%WINDIR%\syswow64\sc.exe' start Wwanip
- '<SYSTEM32>\svchost.exe' -B --donate-level=1 -a null --url=gulf.moneroocean.stream:10004 -u 45dLToERxNfcTR3AH2tJmr3xP3wuDyeap9UTaH5EtMHyB9zEeUN9XMo6PMdHFGjNkKgPKiAGZeQjtbVWLML3J6Bc1rYAGDY -p Homerigx -t 0.8 --max-cpu-u...
