Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows protection
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /FI "imagename eq Windows Protection.exe"
Modifies file system
Creates the following files
- %TEMP%\aut48e2.tmp
- %ALLUSERSPROFILE%\defender\windows protection.exe
- %TEMP%\aut82c9.tmp
- %ALLUSERSPROFILE%\defender\winring0x64.sys
- %TEMP%\aut82f8.tmp
- %ALLUSERSPROFILE%\defender\start.exe
- %TEMP%\aut8328.tmp
- %ALLUSERSPROFILE%\defender\start.vbs
- %TEMP%\aut8348.tmp
- %ALLUSERSPROFILE%\defender\k.bat
- %TEMP%\aut8369.tmp
- %ALLUSERSPROFILE%\defender\k.vbs
- %ALLUSERSPROFILE%\defender\p.vbs
- %TEMP%\resd7d8.tmp
- %TEMP%\aut83b9.tmp
- %ALLUSERSPROFILE%\defender\s.vbs
- %TEMP%\aut83e8.tmp
- %ALLUSERSPROFILE%\defender\s.bat
- %TEMP%\aut8409.tmp
- %ALLUSERSPROFILE%\defender\timeout.ps1
- %TEMP%\9980.tmp\9981.tmp\9982.bat
- %TEMP%\cwxkms5f.0.cs
- %TEMP%\cwxkms5f.cmdline
- %TEMP%\cwxkms5f.out
- %TEMP%\cscd7c8.tmp
- %TEMP%\aut80d4.tmp
- %TEMP%\aut8398.tmp
- %ALLUSERSPROFILE%\task host\svchost.exe
- %TEMP%\aut4a6e.tmp
- %ALLUSERSPROFILE%\defender\a.exe
- %TEMP%\aut4931.tmp
- %ALLUSERSPROFILE%\defender\d.bat
- %TEMP%\aut4960.tmp
- %ALLUSERSPROFILE%\defender\d.vbs
- %TEMP%\aut49a0.tmp
- %ALLUSERSPROFILE%\defender\w.bat
- %TEMP%\aut49d0.tmp
- %ALLUSERSPROFILE%\defender\d.exe
- %TEMP%\aut4a2e.tmp
- %ALLUSERSPROFILE%\defender\t.bat
- %ALLUSERSPROFILE%\defender\t.vbs
- %ALLUSERSPROFILE%\defender\config.json
- %TEMP%\aut5f75.tmp
- %ALLUSERSPROFILE%\defender\ab.exe
- %ALLUSERSPROFILE%\defender\dc.ini
- %ALLUSERSPROFILE%\defender\dd.bat
- %ALLUSERSPROFILE%\defender\ddd.bat
- %ALLUSERSPROFILE%\defender\dc.exe
- %ALLUSERSPROFILE%\defender\dd.vbs
- %TEMP%\aut73e0.tmp
- %ALLUSERSPROFILE%\defender\ac.exe
- %ALLUSERSPROFILE%\defender\min.exe
- %TEMP%\aut7fd9.tmp
- %TEMP%\aut7ff9.tmp
- %TEMP%\cwxkms5f.dll
Deletes the following files
- %TEMP%\aut48e2.tmp
- %TEMP%\cwxkms5f.out
- %TEMP%\cwxkms5f.cmdline
- %TEMP%\cwxkms5f.dll
- %TEMP%\cscd7c8.tmp
- %TEMP%\resd7d8.tmp
- %TEMP%\9980.tmp\9981.tmp\9982.bat
- %TEMP%\aut8409.tmp
- %TEMP%\aut83e8.tmp
- %TEMP%\aut83b9.tmp
- %TEMP%\aut8398.tmp
- %TEMP%\aut8369.tmp
- %TEMP%\aut8348.tmp
- %TEMP%\cwxkms5f.0.cs
- %TEMP%\aut8328.tmp
- %TEMP%\aut82c9.tmp
- %TEMP%\aut80d4.tmp
- %TEMP%\aut7ff9.tmp
- %TEMP%\aut7fd9.tmp
- %TEMP%\aut73e0.tmp
- %TEMP%\aut5f75.tmp
- %TEMP%\aut4a6e.tmp
- %TEMP%\aut4a2e.tmp
- %TEMP%\aut49d0.tmp
- %TEMP%\aut49a0.tmp
- %TEMP%\aut4960.tmp
- %TEMP%\aut4931.tmp
- %TEMP%\aut82f8.tmp
- %TEMP%\cwxkms5f.pdb
Network activity
Connects to
- '17#.#4.88.173':5501
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Defender\d.vbs"
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Defender\k.vbs"
- '%ALLUSERSPROFILE%\task host\svchost.exe'
- '%ALLUSERSPROFILE%\defender\windows protection.exe'
- '%ALLUSERSPROFILE%\defender\start.exe'
- '%ALLUSERSPROFILE%\defender\min.exe'
- '%ALLUSERSPROFILE%\defender\d.exe' 61 %ALLUSERSPROFILE%\Defender\d.bat
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Defender\s.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Defender\dd.vbs"
- '%ALLUSERSPROFILE%\defender\ab.exe' -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Defender\p.vbs"
- '%ALLUSERSPROFILE%\defender\d.exe' 61 %ALLUSERSPROFILE%\Defender\dd.bat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy Unrestricted %ALLUSERSPROFILE%\Defender\timeout.ps1
- '%ALLUSERSPROFILE%\defender\ac.exe' -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
- '%ALLUSERSPROFILE%\defender\d.exe' 61 %ALLUSERSPROFILE%\Defender\d.bat' (with hidden window)
- '%ALLUSERSPROFILE%\task host\svchost.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cwxkms5f.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\k.bat" "' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD7D8.tmp" "%TEMP%\CSCD7C8.tmp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9980.tmp\9981.tmp\9982.bat %ALLUSERSPROFILE%\Defender\Start.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\s.bat" "' (with hidden window)
- '%ALLUSERSPROFILE%\defender\d.exe' 61 %ALLUSERSPROFILE%\Defender\dd.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\t.bat" "' (with hidden window)
- '%ALLUSERSPROFILE%\defender\windows protection.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\t.bat" "
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN "Windows Protection" /TR "%ALLUSERSPROFILE%\Defender\Start.exe" /f
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9980.tmp\9981.tmp\9982.bat %ALLUSERSPROFILE%\Defender\Start.exe"
- '<SYSTEM32>\timeout.exe' /t 10
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\s.bat" "
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cwxkms5f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD7D8.tmp" "%TEMP%\CSCD7C8.tmp"
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\k.bat" "
