Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /PID 1044
Modifies file system
Creates the following files
- %APPDATA%\microsoft\security\windows security.exe
- nul
- %TEMP%\tmp6c1a.vbs
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\security\windows security.exe
Deletes the following files
- %TEMP%\tmp6c1a.vbs
Deletes itself.
Network activity
Connects to
- '19#.#33.48.87':27941
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
Creates and executes the following
- '%APPDATA%\microsoft\security\windows security.exe'
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\tmp6C1A.vbs
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\Windows Security.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /PID 1044 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate(...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\Windows Security.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /PID 1044 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate(...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate()"
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : ...
