Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\explorer_u.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\winupdate.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\explorer.exe
Malicious functions
Downloads
- https://resimupdate.com/i/explorer-uninstaller1621938727.png as .\explorer_u.exe
- https://i.resm.im/e1dbr34.png as .\winupdate.exe
- https://i.resm.im/psu60pj.png as .\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\476b.tmp\476c.bat
Deletes the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\explorer_u.exe
- %TEMP%\476b.tmp\476c.bat
Network activity
Connects to
- 're###update.com':443
- 'microsoft.com':80
- 'i.##sm.im':443
TCP
Other
- 're###update.com':443
- 'i.##sm.im':443
UDP
- DNS ASK re###update.com
- DNS ASK microsoft.com
- DNS ASK i.##sm.im
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\explorer_u.exe'
- '%APPDATA%\microsoft\windows\start menu\programs\startup\winupdate.exe'
- '%APPDATA%\microsoft\windows\start menu\programs\startup\explorer.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "explorer" /tr '"%APPDATA%\explorer.exe"' & exit' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\476B.tmp\476C.bat <Full path to file>"
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows Update" /sc ONLOGON /tr "%TEMP%\WinUpdate.exe" /rl HIGHEST /f
- '<SYSTEM32>\timeout.exe' /t 5
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "%APPDATA%\Microsoft\Libs\sihost64.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Libs\sihost64.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "<SYSTEM32>\WinUpdate.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "<SYSTEM32>\WinUpdate.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "%TEMP%\WinUpdate.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%TEMP%\WinUpdate.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "%APPDATA%\explorer.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%APPDATA%\explorer.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "%APPDATA%\Services.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%APPDATA%\Services.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "%APPDATA%\Microsoft\Windows\Start` Menu\Programs\Startup\WinUpdate.exe""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start` Menu\Programs\Startup\WinUpdate.exe""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionProcess "%APPDATA%\Microsoft\Windows\Start` Menu\Programs\Startup\explorer.exe""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start` Menu\Programs\Startup\explorer.exe""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start` Menu\Programs\Startup"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Remove-MpPreference -ExclusionExtension ".exe""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass IEX
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "explorer" /tr '"%APPDATA%\explorer.exe"' & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "explorer" /tr '"%APPDATA%\explorer.exe"'
