Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' -F -FI "IMAGENAME eq SystemSettings.exe"
- '<SYSTEM32>\net.exe' stop wuauserv
- '<SYSTEM32>\net.exe' stop UsoSvc
- '<SYSTEM32>\taskkill.exe' /f /im OneDrive.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\fps.bat
- nul
- %TEMP%\removexbox.ps1
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""%TEMP%\removexbox.ps1""' -Verb RunAs}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\removexbox.ps1
Executes the following
- '<SYSTEM32>\cmd.exe' /c fps.bat
- '<SYSTEM32>\sc.exe' stop "SysMain"
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "SetDisableUXWUAccess" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DoNotConnectToWindowsUpdateInternetLocations" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\net1.exe' stop UsoSvc
- '<SYSTEM32>\net1.exe' stop wuauserv
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\bcdedit.exe' /deletevalue disabledynamictick
- '<SYSTEM32>\bcdedit.exe' /deletevalue useplatformtick
- '<SYSTEM32>\bcdedit.exe' /deletevalue useplatformclock
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\MemoryManagement\PrefetchParameters /V EnableSuperfetcher /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\MemoryManagement\PrefetchParameters /V EnablePrefetcher /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameDVR /V value /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKCU\System\GameConfigStore /V GameDVR_Enabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\timeout.exe' 5
- '<SYSTEM32>\sc.exe' config "SysMain" start=disabled
- '<SYSTEM32>\raserver.exe' /offerraupdate
