Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows service В© microsoft corporation
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Windows\CPU\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Windows\CPU\WinRing0x64.sys
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %LOCALAPPDATA%\nsambex0.exe
- %TEMP%\tmp5fc6.tmp
- %TEMP%\tmp5fc5.tmp
- %TEMP%\tmp5fc4.tmp
- %TEMP%\tmp5fc3.tmp
- %TEMP%\tmp5fb2.tmp
- %TEMP%\tmp5fb1.tmp
- %TEMP%\tmp5fb0.tmp
- %TEMP%\tmp5faf.tmp
- %TEMP%\tmp5f9f.tmp
- %TEMP%\tmp5f9e.tmp
- %TEMP%\tmp5f9d.tmp
- %TEMP%\tmp5f9c.tmp
- %TEMP%\tmp5f8b.tmp
- %TEMP%\tmp5f8a.tmp
- %TEMP%\tmp5f89.tmp
- %TEMP%\tmp5f88.tmp
- %TEMP%\tmp5f78.tmp
- %TEMP%\tmp5f77.tmp
- %TEMP%\tmp5f76.tmp
- %TEMP%\tmp5f75.tmp
- %TEMP%\tmp5f64.tmp
- %TEMP%\tmp5f63.tmp
- %TEMP%\tmp5f62.tmp
- %TEMP%\tmp5fc7.tmp
- %TEMP%\tmp5fd9.tmp
- %APPDATA%\windows\cpu\cpu.exe
- %TEMP%\tmp5fda.tmp
- %APPDATA%\windows\cpu\config.json
- %TEMP%\tmp606c.tmp
- %TEMP%\tmp605c.tmp
- %TEMP%\tmp604b.tmp
- %TEMP%\tmp603b.tmp
- %TEMP%\tmp602a.tmp
- %TEMP%\tmp6029.tmp
- %TEMP%\tmp6028.tmp
- %TEMP%\tmp6027.tmp
- %TEMP%\tmp6016.tmp
- %TEMP%\tmp6015.tmp
- %TEMP%\tmp6014.tmp
- %TEMP%\tmp6013.tmp
- %TEMP%\tmp6003.tmp
- %TEMP%\tmp6002.tmp
- %TEMP%\tmp6001.tmp
- %TEMP%\tmp6000.tmp
- %TEMP%\tmp5fff.tmp
- %TEMP%\tmp5fee.tmp
- %TEMP%\tmp5fed.tmp
- %TEMP%\tmp5fec.tmp
- %TEMP%\tmp5fdc.tmp
- %TEMP%\tmp5fdb.tmp
- %TEMP%\tmp5f61.tmp
- %TEMP%\tmp5fd8.tmp
- %TEMP%\tmp5f50.tmp
- %TEMP%\tmp5eb8.tmp
- %TEMP%\tmp5ea6.tmp
- %TEMP%\tmp5ea5.tmp
- %TEMP%\tmp5e94.tmp
- %TEMP%\tmp5e93.tmp
- %TEMP%\tmp5e92.tmp
- %TEMP%\tmp5e91.tmp
- %TEMP%\tmp5e81.tmp
- %TEMP%\tmp5e80.tmp
- %TEMP%\tmp5e7f.tmp
- %TEMP%\tmp5e6e.tmp
- %TEMP%\tmp5e6d.tmp
- %TEMP%\tmp5e6c.tmp
- %TEMP%\tmp5e5c.tmp
- %TEMP%\tmp5e5b.tmp
- %TEMP%\tmp5e4a.tmp
- %TEMP%\tmp5e49.tmp
- %TEMP%\tmp5e48.tmp
- %TEMP%\tmp5e47.tmp
- %TEMP%\tmp5e08.tmp
- %TEMP%\tmp5df7.tmp
- %APPDATA%\windows\cpu.zip
- %APPDATA%\windows\rantimebroker.exe
- %LOCALAPPDATA%\cjz0u1v0.exe
- %TEMP%\tmp5eb7.tmp
- %TEMP%\tmp5eb9.tmp
- %TEMP%\tmp5f3f.tmp
- %TEMP%\tmp5eba.tmp
- %TEMP%\tmp5f3e.tmp
- %TEMP%\tmp5f3d.tmp
- %TEMP%\tmp5f2c.tmp
- %TEMP%\tmp5f2b.tmp
- %TEMP%\tmp5f2a.tmp
- %TEMP%\tmp5f1a.tmp
- %TEMP%\tmp5f19.tmp
- %TEMP%\tmp5f18.tmp
- %TEMP%\tmp5f07.tmp
- %TEMP%\tmp5f06.tmp
- %TEMP%\tmp5f05.tmp
- %TEMP%\tmp5f04.tmp
- %TEMP%\tmp5ef3.tmp
- %TEMP%\tmp5ef2.tmp
- %TEMP%\tmp5ef1.tmp
- %TEMP%\tmp5ee1.tmp
- %TEMP%\tmp5ee0.tmp
- %TEMP%\tmp5edf.tmp
- %TEMP%\tmp5ede.tmp
- %TEMP%\tmp5ecd.tmp
- %TEMP%\tmp5ecc.tmp
- %TEMP%\tmp5ecb.tmp
- %TEMP%\tmp5eca.tmp
- %TEMP%\tmp5f4f.tmp
- %APPDATA%\windows\cpu\winring0x64.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\windows\rantimebroker.exe
- %APPDATA%\windows\cpu.zip
- %APPDATA%\windows\cpu\cpu.exe
Deletes the following files
- %TEMP%\tmp5e08.tmp
- %TEMP%\tmp5f78.tmp
- %TEMP%\tmp5f89.tmp
- %TEMP%\tmp5f8b.tmp
- %TEMP%\tmp5f9d.tmp
- %TEMP%\tmp5f9f.tmp
- %TEMP%\tmp5fb0.tmp
- %TEMP%\tmp5fb2.tmp
- %TEMP%\tmp5fc4.tmp
- %TEMP%\tmp5fc6.tmp
- %TEMP%\tmp5fd8.tmp
- %TEMP%\tmp5fda.tmp
- %TEMP%\tmp5fdc.tmp
- %TEMP%\tmp5fed.tmp
- %TEMP%\tmp5fff.tmp
- %TEMP%\tmp6001.tmp
- %TEMP%\tmp6003.tmp
- %TEMP%\tmp6014.tmp
- %TEMP%\tmp6016.tmp
- %TEMP%\tmp6028.tmp
- %TEMP%\tmp602a.tmp
- %TEMP%\tmp603b.tmp
- %TEMP%\tmp604b.tmp
- %TEMP%\tmp605c.tmp
- %TEMP%\tmp5f76.tmp
- %TEMP%\tmp606c.tmp
- %TEMP%\tmp5f64.tmp
- %TEMP%\tmp5f50.tmp
- %TEMP%\tmp5e48.tmp
- %TEMP%\tmp5e4a.tmp
- %TEMP%\tmp5e5c.tmp
- %TEMP%\tmp5e6d.tmp
- %TEMP%\tmp5e7f.tmp
- %TEMP%\tmp5e81.tmp
- %TEMP%\tmp5e92.tmp
- %TEMP%\tmp5e94.tmp
- %TEMP%\tmp5ea6.tmp
- %TEMP%\tmp5eb8.tmp
- %TEMP%\tmp5eba.tmp
- %TEMP%\tmp5ecb.tmp
- %TEMP%\tmp5ecd.tmp
- %TEMP%\tmp5edf.tmp
- %TEMP%\tmp5ee1.tmp
- %TEMP%\tmp5ef2.tmp
- %TEMP%\tmp5f04.tmp
- %TEMP%\tmp5f06.tmp
- %TEMP%\tmp5f18.tmp
- %TEMP%\tmp5f1a.tmp
- %TEMP%\tmp5f2b.tmp
- %TEMP%\tmp5f3d.tmp
- %TEMP%\tmp5f3f.tmp
- %TEMP%\tmp5f62.tmp
- %APPDATA%\windows\cpu.zip
Network activity
Connects to
- 'ip###ger.org':443
- 'microsoft.com':80
- 'pa###bin.com':443
- '19#.2.84.91':80
- '87.##1.71.75':3214
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://87.###.71.75:3214/ via 87.##1.71.75
UDP
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
- DNS ASK pa###bin.com
- DNS ASK bl##.#gencia10x.com
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
- DNS ASK po##.#inexmr.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\nsambex0.exe'
- '%LOCALAPPDATA%\cjz0u1v0.exe'
- '%APPDATA%\windows\rantimebroker.exe'
- '%APPDATA%\windows\cpu\cpu.exe' -o stratum+tcp://pool.minexmr.com:4444 --algo cn/r -u 42ZYH6myZTcdLqfmCpSCggN8ppdku4PK16kH8UFFyTesddFwT5ihd2QFsWS2BGnuwXWfnrtbJbr5w7dqgeBRZDJcUzia53j./ --donate-level=1
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "Windows Service В© Microsoft Corporation" /tr "%APPDATA%\Windows\RantimeBroker.exe" /f' (with hidden window)
- '%APPDATA%\windows\rantimebroker.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "Windows Service В© Microsoft Corporation" /tr "%APPDATA%\Windows\RantimeBroker.exe" /f
- '<SYSTEM32>\taskeng.exe' {AE672532-EBE9-4049-BE05-333137421B2A} S-1-5-21-1960123792-2022915161-3775307078-1001:oeeqlpwx\user:Interactive:[1]
