Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RuntimeBroker' = '<Full path to file>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityHealthSystray' = '<SYSTEM32>\SecurityHealthSystray.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefender' = '%ProgramFiles%\Windows Defender\MpCmdRun.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Cortana' = '%ProgramFiles%\WindowsApps\Microsoft.x64__8wekyb3gfdfdgd8bbwe\Cortana.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WmiPrvSE' = '<SYSTEM32>\wbem\WmiPrvSE.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AntiMalwareServiceExecutable' = '%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MsMpEng.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdgeUpd' = '%ProgramFiles%\WindowsApps\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveService' = '%ProgramFiles%\WindowsApps\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'NvStray' = '%ProgramFiles%\WindowsApps\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftedgeupd
- <SYSTEM32>\tasks\antimalwaresericeexecutable\antimalwaresericeexecutableservice_bk6061
- <SYSTEM32>\tasks\nvstray
- <SYSTEM32>\tasks\antimalwareserviceexecutable
- <SYSTEM32>\tasks\windowsdefender
- <SYSTEM32>\tasks\microsoftupdateservices\microsoftupdateservicesservice_bk6052
- <SYSTEM32>\tasks\runtimebroker
- <SYSTEM32>\tasks\settingsyshost\settingsyshostservice_bk3279
- <SYSTEM32>\tasks\securityhealthsystray
- <SYSTEM32>\tasks\wmiprvse
- <SYSTEM32>\tasks\onedriveservice
- <SYSTEM32>\tasks\windowsdefenderservices\windowsdefenderservicesservice_bk1922
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Network activity
Connects to
- 're##ry.co':443
- 'microsoft.com':80
- 'st####.gofile.io':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 're##ry.co':443
- 'st####.gofile.io':443
UDP
- DNS ASK re##ry.co
- DNS ASK microsoft.com
- DNS ASK st####.gofile.io
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "OneDriveService" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3279" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1922" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "NvStray" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3279" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6052" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6061" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1922" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "WindowsDefender" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6052" /TR "<Full path to file>"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6061" /TR "<Full path to file>"
