Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\NetworkAgent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NetworkAgent] 'ImagePath' = '%WINDIR%\SysWOW64\wwtask.exe -service'
- [<HKLM>\System\CurrentControlSet\Services\AwtaskService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AwtaskService] 'ImagePath' = '%WINDIR%\NetworkClient\API\awtask.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Tz0HookInjectionDriver] 'ImagePath' = '%WINDIR%\NetworkClient\Driver\awtask64.sys'
Creates the following services
- 'NetworkAgent' %WINDIR%\SysWOW64\wwtask.exe -service
- 'AwtaskService' %WINDIR%\NetworkClient\API\awtask.exe
- 'Tz0HookInjectionDriver' %WINDIR%\NetworkClient\Driver\awtask64.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NetworkClient\API\Tz0TVNC.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NetworkClient\API\Tz0TRC.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NetworkClient\API\Tz0TRX.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\wwtask.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NetworkClient' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\Tz0FF.sys' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\NetworkClient\Driver\tz0otfe.sys' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>\Tz0OTFESB.sys' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Processes] 'wwtask.exe' = '00000000'
- [<HKLM>\Software\Microsoft\Windows Defender\Exclusions\Processes] 'awtask.exe' = '00000000'
Modifies file system
Creates the following files
- %WINDIR%\networkclient\cfg\core.cfg
- %WINDIR%\temp\~tmpc8c16af6344a4621b0c16d87c3329f56.tmp
- %WINDIR%\temp\~tmpbc0932c469144d538d7b5d14811ce406.bat
- %WINDIR%\temp\~tmp1d2f0e0c0d924cbcb51a82d2710a654a.tmp
- %WINDIR%\temp\~tmp425328b74bfa4c15ab44ce707f8cd9c6.bat
- %WINDIR%\temp\~tmpcb2f3fd939b846818e744de0e2538586.tmp
- %WINDIR%\temp\~tmp660e79c0d12c40e0a3e76d7ba64ee7b4.bat
- %WINDIR%\temp\udd423d.tmp
- %WINDIR%\networkclient\data\tz0awt.dat
- %WINDIR%\networkclient\library\awtask64.dll
- %WINDIR%\networkclient\driver\awtask64.sys
- %WINDIR%\networkclient\library\awtask32.dll
- C:\stepbystep\t0_steps_20220924_cloud.txt
- C:\stepbystep\t0_steps_20220924_journal.txt
- %WINDIR%\networkclient\data\tz0mj.data
- %WINDIR%\networkclient\data\tz0act.data
- %WINDIR%\networkclient\cfg\guard.cfg
- %WINDIR%\networkclient\cfg\perf.cfg
- %WINDIR%\networkclient\api\awtask.exe
- %WINDIR%\networkclient\cfg\dbsec.cfg
- %WINDIR%\networkclient\data\tz0adv.data
- %WINDIR%\networkclient\cfg\cert.cfg
- %WINDIR%\syswow64\wwtask.exe
- C:\stepbystep\t0_steps_20220924_debug.txt
- %WINDIR%\networkclient\data\tz0deb.data
- C:\stepbystep\t0_steps_20220924.txt
- %WINDIR%\networkclient\cfg\bclog.cfg
- C:\stepbystep\t0_steps_20220924_awtask.txt
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\wwtask.exe
Deletes the following files
- %WINDIR%\networkclient\cfg\cert.cfg
- %WINDIR%\temp\udd423d.tmp
- %WINDIR%\temp\~tmpcb2f3fd939b846818e744de0e2538586.tmp
- %WINDIR%\temp\~tmp660e79c0d12c40e0a3e76d7ba64ee7b4.bat
- %WINDIR%\temp\~tmp1d2f0e0c0d924cbcb51a82d2710a654a.tmp
- %WINDIR%\temp\~tmp425328b74bfa4c15ab44ce707f8cd9c6.bat
- %WINDIR%\temp\~tmpc8c16af6344a4621b0c16d87c3329f56.tmp
- %WINDIR%\temp\~tmpbc0932c469144d538d7b5d14811ce406.bat
- %WINDIR%\networkclient\data\tz0awt.dat
Substitutes the following files
- %WINDIR%\networkclient\cfg\cert.cfg
Network activity
Connects to
- 'ch####p.dyndns.org':80
- 'tz#.##ttia.com.br':770
- '<LOCALNET>.67.22':43591
- 'tz#.##ttia.com.br':81
TCP
HTTP GET requests
- http://ch####p.dyndns.org/
UDP
- DNS ASK ch####p.dyndns.org
- DNS ASK tz#.##ttia.com.br
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Program Manager'
Creates and executes the following
- '%WINDIR%\syswow64\wwtask.exe' -service
- '%WINDIR%\syswow64\wwtask.exe' nn
- '%WINDIR%\networkclient\api\awtask.exe' /install /silent
- '%WINDIR%\networkclient\api\awtask.exe'
- '%WINDIR%\syswow64\wwtask.exe' nn' (with hidden window)
- '%WINDIR%\networkclient\api\awtask.exe' /install /silent' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\TEMP\~tmp660E79C0D12C40E0A3E76D7BA64EE7B4.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\TEMP\~tmp425328B74BFA4C15AB44CE707F8CD9C6.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\TEMP\~tmpBC0932C469144D538D7B5D14811CE406.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\TEMP\~tmp660E79C0D12C40E0A3E76D7BA64EE7B4.bat" "
- '%WINDIR%\syswow64\auditpol.exe' /get /category:Logon/Logoff /r
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\TEMP\~tmp425328B74BFA4C15AB44CE707F8CD9C6.bat" "
- '%WINDIR%\syswow64\auditpol.exe' /set /category:"Logon/Logoff" /success:enable /failure:enable
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\TEMP\~tmpBC0932C469144D538D7B5D14811CE406.bat" "
