Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\mscfile\shell\open\command] '' = '%APPDATA%\WindowsDefender\WindowsDefender.exe'
Modifies file system
Creates the following files
- %APPDATA%\windowsdefender\windowsdefender.exe
- %TEMP%\440305395\control-port-832817565.tmp
- %TEMP%\440305395\state.tmp
- %TEMP%\440305395\control_auth_cookie.tmp
- %TEMP%\440305395\unverified-microdesc-consensus.tmp
- %TEMP%\440305395\cached-certs.tmp
- %TEMP%\440305395\cached-microdesc-consensus.tmp
- %TEMP%\440305395\cached-microdescs.new
Deletes the following files
- %TEMP%\440305395\control-port-832817565
- %TEMP%\440305395\unverified-microdesc-consensus
Moves the following files
- from %TEMP%\440305395\control-port-832817565.tmp to %TEMP%\440305395\control-port-832817565
- from %TEMP%\440305395\state.tmp to %TEMP%\440305395\state
- from %TEMP%\440305395\control_auth_cookie.tmp to %TEMP%\440305395\control_auth_cookie
- from %TEMP%\440305395\unverified-microdesc-consensus.tmp to %TEMP%\440305395\unverified-microdesc-consensus
- from %TEMP%\440305395\cached-certs.tmp to %TEMP%\440305395\cached-certs
- from %TEMP%\440305395\cached-microdesc-consensus.tmp to %TEMP%\440305395\cached-microdesc-consensus
Substitutes the following files
- %TEMP%\440305395\control-port-832817565.tmp
- %TEMP%\440305395\control-port-832817565
Network activity
Connects to
- 'localhost':49174
- '37.##7.115.157':9001
- '21#.#7.229.2':9001
- '16#.#72.154.162':9001
- '17#.#7.170.156':9001
- '85.##8.227.163':9001
- '5.#.147.226':9001
- '66.#11.2.20':9001
- '18#.#00.86.182':8080
- '94.##2.242.84':443
- '45.##.108.130':9001
- '12#.31.0.13':443
- '21#.#41.138.174':9001
- '19#.#91.81.7':9001
- '13#.#43.214.137':443
- '85.##5.250.88':443
- '93.##7.67.71':8080
- '14#.#51.190.229':9010
- '19#.#34.15.62':443
- '54.##.138.138':993
- '21#.#2.199.190':443
- 'localhost':49176
- '18#.#20.101.32':20032
- '85.##.159.65':80
- '17#.#5.193.77':443
- '85.##.201.47':9001
- '17#.#3.183.251':443
- '18#.#20.101.28':20028
- '78.##.18.110':80
- '12#.31.0.34':9101
- '19#.#34.15.57':443
- '19#.#0.112.165':443
- '64.##.152.132':443
- '18#.#00.84.82':443
- '81.#.10.251':443
- '21#.#1.134.123':9001
- '19#.#1.114.43':9001
- '19#.#7.28.28':9001
- '18#.#20.101.9':20009
TCP
Other
- 'localhost':49176
- '19#.#91.81.7':9001
- '45.##.108.130':9001
- '12#.31.0.13':443
- '18#.#00.86.182':8080
- '66.#11.2.20':9001
- '19#.#34.15.62':443
- '21#.#7.229.2':9001
- '16#.#72.154.162':9001
- '14#.#51.190.229':9010
- '21#.#41.138.174':9001
- '37.##7.115.157':9001
- '12#.31.0.34':9101
- '64.##.152.132':443
- '19#.#7.28.28':9001
- '19#.#34.15.57':443
- '78.##.18.110':80
- '19#.#0.112.165':443
- '19#.#1.114.43':9001
- '17#.#5.193.77':443
- 'localhost':49177
- '54.##.138.138':993
- '93.##7.67.71':8080
Miscellaneous
Creates and executes the following
- '%APPDATA%\windowsdefender\windowsdefender.exe'
- '%APPDATA%\windowsdefender\windowsdefender.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' ver
- '<SYSTEM32>\eventvwr.exe'
