Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\WindowDefender] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WindowDefender] 'ImagePath' = '%WINDIR%\Fonts\WindowsDefender\mwmc.exe'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\fonts\windowsdefender\config.json
- %WINDIR%\fonts\windowsdefender\winring0x64.sys
- %WINDIR%\fonts\windowsdefender\mcmpeng.exe
- %WINDIR%\fonts\windowsdefender\mwmc.exe
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\0oi49m1a\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\uyueet2h\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\kjtf1xoj\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\1a6wyqio\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\low\index.dat
- %WINDIR%\fonts\windowsdefender\winlogon.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\index.dat
- %WINDIR%\fonts\windowsdefender\local.txt
- %WINDIR%\fonts\windowsdefender\platform\nvrtc-builtins64_101.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\niu0g462\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\mhjatq37\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ifiorx1k\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rkn9gtlr\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %WINDIR%\fonts\inetsrv\inetmngr.exe
- %WINDIR%\fonts\windowsdefender\platform\config.json
- %WINDIR%\fonts\windowsdefender\platform\winring0x64.sys
- %WINDIR%\fonts\windowsdefender\platform\xmrig-cuda.dll
- %WINDIR%\fonts\windowsdefender\platform\nvrtc64_101_0.dll
- %WINDIR%\fonts\windowsdefender\platform\securitypolicyconfig.exe
- %WINDIR%\fonts\windowsdefender\cmdrun.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\1a6wyqio\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\kjtf1xoj\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\uyueet2h\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\0oi49m1a\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\rkn9gtlr\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ifiorx1k\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\mhjatq37\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\niu0g462\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
Network activity
TCP
HTTP GET requests
- http://18#.#89.12.75/mysql/64/config.json
- http://18#.#89.12.75/mysql/64/WinRing0x64.sys
- http://18#.#89.12.75/mysql/64/McMpEng.exe
- http://18#.#89.12.75/mysql/64/CmdRun.exe
- http://18#.#89.12.75/mysql/InetMngr.exe
- http://18#.#89.12.75/mysql/64/SQL/config.json
- http://18#.#89.12.75/mysql/64/SQL/WinRing0x64.sys
- http://18#.#89.12.75/mysql/64/SQL/xmrig-cuda.dll
- http://18#.#89.12.75/mysql/64/SQL/nvrtc64_101_0.dll
- http://18#.#89.12.75/mysql/64/SQL/nvrtc-builtins64_101.dll
- http://18#.#89.12.75/mysql/64/SQL/SecurityPolicyConfig.exe
- http://18#.#89.12.75/mysql/64/server.txt
- http://18#.#89.12.75/mysql/64/winlogon.exe
- http://18#.#89.12.75/mysql/mwmc.exe
Miscellaneous
Creates and executes the following
- '%WINDIR%\fonts\inetsrv\inetmngr.exe'
- '%WINDIR%\fonts\windowsdefender\platform\securitypolicyconfig.exe'
- '%WINDIR%\fonts\windowsdefender\mwmc.exe' install WindowDefender %WINDIR%\Fonts\WindowsDefender\winlogon.exe
- '%WINDIR%\fonts\windowsdefender\mwmc.exe' start WindowDefender
- '%WINDIR%\fonts\windowsdefender\mwmc.exe'
- '%WINDIR%\fonts\windowsdefender\winlogon.exe'
- '%WINDIR%\fonts\windowsdefender\mwmc.exe' set WindowDefender start SERVICE_AUTO_START
- '%WINDIR%\fonts\windowsdefender\cmdrun.exe'
- '%WINDIR%\fonts\windowsdefender\mcmpeng.exe' --daemonized
- '%WINDIR%\fonts\inetsrv\inetmngr.exe' ' (with hidden window)
- '%WINDIR%\fonts\windowsdefender\platform\securitypolicyconfig.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %WINDIR%\Fonts\WindowsDefender && mwmc install WindowDefender %WINDIR%\Fonts\WindowsDefender\winlogon.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %WINDIR%\Fonts\WindowsDefender && mwmc start WindowDefender' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %WINDIR%\Fonts\WindowsDefender && mwmc set WindowDefender start SERVICE_AUTO_START && mwmc start WindowDefender' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /ru "" /sc minute /mo 1 /tn WindowDefender /tr "<SYSTEM32>\cmd.exe /c cd %WINDIR%\Fonts\WindowsDefender & mwmc install WindowDefender %WINDIR%\Fonts\WindowsDefender\winlogon...' (with hidden window)
- '%WINDIR%\fonts\windowsdefender\cmdrun.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c cd %WINDIR%\Fonts\WindowsDefender && mwmc install WindowDefender %WINDIR%\Fonts\WindowsDefender\winlogon.exe
- '%WINDIR%\syswow64\cmd.exe' /c cd %WINDIR%\Fonts\WindowsDefender && mwmc start WindowDefender
- '%WINDIR%\syswow64\cmd.exe' /c cd %WINDIR%\Fonts\WindowsDefender && mwmc set WindowDefender start SERVICE_AUTO_START && mwmc start WindowDefender
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /ru "" /sc minute /mo 1 /tn WindowDefender /tr "<SYSTEM32>\cmd.exe /c cd %WINDIR%\Fonts\WindowsDefender & mwmc install WindowDefender %WINDIR%\Fonts\WindowsDefender\winlogon...
- '%WINDIR%\syswow64\schtasks.exe' /Create /ru "" /sc minute /mo 1 /tn WindowDefender /tr "<SYSTEM32>\cmd.exe /c cd %WINDIR%\Fonts\WindowsDefender & mwmc install WindowDefender %WINDIR%\Fonts\WindowsDefender\winlogon.exe & mwmc ...
- '<SYSTEM32>\cmd.exe' /c "%WINDIR%\Fonts\WindowsDefender\McMpEng.exe" --daemonized
