Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %HOMEPATH%\AppData"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %HOMEPATH%\Local"
Modifies file system
Creates the following files
- %TEMP%\_mei50042\crypto\cipher\_arc4.pyd
- %TEMP%\_mei50042\pywin32_system32\pywintypes310.dll
- %TEMP%\_mei50042\pywin32_system32\pythoncom310.dll
- %TEMP%\_mei50042\python310.dll
- %TEMP%\_mei50042\python3.dll
- %TEMP%\_mei50042\pyexpat.pyd
- %TEMP%\_mei50042\psutil\_psutil_windows.pyd
- %TEMP%\_mei50042\numpy\random\mtrand.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\bit_generator.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_sfc64.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_philox.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_pcg64.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_mt19937.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_generator.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_common.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\random\_bounded_integers.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\linalg\lapack_lite.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\fft\_pocketfft_internal.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\core\_multiarray_umath.cp310-win_amd64.pyd
- %TEMP%\_mei50042\numpy\core\_multiarray_tests.cp310-win_amd64.pyd
- %TEMP%\_mei50042\libssl-1_1.dll
- %TEMP%\_mei50042\libopenblas64__v0.3.23-246-g3d31191b-gcc_10_3_0.dll
- %TEMP%\_mei50042\libffi-7.dll
- %TEMP%\_mei50042\libcrypto-1_1.dll
- %TEMP%\_mei50042\cv2\opencv_videoio_ffmpeg480_64.dll
- %TEMP%\_mei50042\cv2\cv2.pyd
- %TEMP%\_mei50042\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
- %TEMP%\_mei50042\_uuid.pyd
- %TEMP%\_mei50042\charset_normalizer\md.cp310-win_amd64.pyd
- %TEMP%\_mei50042\select.pyd
- %TEMP%\_mei50042\sqlite3.dll
- %TEMP%\_mei50042\cv2\version.py
- %TEMP%\_mei50042\cv2\utils\__init__.py
- %TEMP%\_mei50042\cv2\typing\__init__.py
- %TEMP%\_mei50042\cv2\misc\version.py
- %TEMP%\_mei50042\cv2\misc\__init__.py
- %TEMP%\_mei50042\cv2\mat_wrapper\__init__.py
- %TEMP%\_mei50042\cv2\load_config_py3.py
- %TEMP%\_mei50042\cv2\gapi\__init__.py
- %TEMP%\_mei50042\cv2\data\__init__.py
- %TEMP%\_mei50042\cv2\config.py
- %TEMP%\_mei50042\cv2\config-3.py
- %TEMP%\_mei50042\cv2\__init__.py
- %TEMP%\_mei50042\certifi\cacert.pem
- %TEMP%\_mei50042\attrs-23.1.0.dist-info\licenses\license
- %TEMP%\_mei50042\pil\_webp.cp310-win_amd64.pyd
- %TEMP%\_mei50042\attrs-23.1.0.dist-info\wheel
- %TEMP%\_mei50042\attrs-23.1.0.dist-info\record
- %TEMP%\_mei50042\attrs-23.1.0.dist-info\metadata
- %TEMP%\_mei50042\attrs-23.1.0.dist-info\installer
- %TEMP%\_mei50042\win32com\shell\shell.pyd
- %TEMP%\_mei50042\win32\win32trace.pyd
- %TEMP%\_mei50042\win32\win32process.pyd
- %TEMP%\_mei50042\win32\win32pdh.pyd
- %TEMP%\_mei50042\win32\win32gui.pyd
- %TEMP%\_mei50042\win32\win32crypt.pyd
- %TEMP%\_mei50042\win32\win32api.pyd
- %TEMP%\_mei50042\win32\_win32sysloader.pyd
- %TEMP%\_mei50042\unicodedata.pyd
- %TEMP%\_mei50042\_ssl.pyd
- %TEMP%\_mei50042\_sqlite3.pyd
- %TEMP%\_mei50042\_socket.pyd
- %TEMP%\_mei50042\crypto\hash\_sha256.pyd
- %TEMP%\_mei50042\crypto\hash\_sha224.pyd
- %TEMP%\_mei50042\crypto\hash\_sha1.pyd
- %TEMP%\_mei50042\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei50042\crypto\hash\_md5.pyd
- %TEMP%\_mei50042\crypto\hash\_md4.pyd
- %TEMP%\_mei50042\crypto\hash\_md2.pyd
- %TEMP%\_mei50042\crypto\hash\_blake2s.pyd
- %TEMP%\_mei50042\crypto\hash\_blake2b.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei50042\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei50042\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei50042\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei50042\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei50042\crypto\hash\_sha512.pyd
- %TEMP%\_mei50042\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei50042\crypto\hash\_sha384.pyd
- %TEMP%\_mei50042\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei50042\_queue.pyd
- %TEMP%\_mei50042\crypto\hash\_keccak.pyd
- %TEMP%\_mei50042\_overlapped.pyd
- %TEMP%\_mei50042\_multiprocessing.pyd
- %TEMP%\_mei50042\_lzma.pyd
- %TEMP%\_mei50042\_hashlib.pyd
- %TEMP%\_mei50042\_elementtree.pyd
- %TEMP%\_mei50042\_decimal.pyd
- %TEMP%\_mei50042\_ctypes.pyd
- %TEMP%\_mei50042\_bz2.pyd
- %TEMP%\_mei50042\_asyncio.pyd
- %TEMP%\_mei50042\vcruntime140_1.dll
- %TEMP%\_mei50042\vcruntime140.dll
- %TEMP%\_mei50042\pythonwin\win32ui.pyd
- %TEMP%\_mei50042\base_library.zip
- %TEMP%\q33fax_d
- %TEMP%\_mei50042\pil\_imagingtk.cp310-win_amd64.pyd
- %TEMP%\_mei50042\pil\_imagingft.cp310-win_amd64.pyd
- %TEMP%\_mei50042\pil\_imagingcms.cp310-win_amd64.pyd
- %TEMP%\_mei50042\pil\_imaging.cp310-win_amd64.pyd
- %TEMP%\_mei50042\crypto\util\_strxor.pyd
- %TEMP%\_mei50042\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei50042\crypto\publickey\_x25519.pyd
- %TEMP%\_mei50042\crypto\publickey\_ed448.pyd
- %TEMP%\_mei50042\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei50042\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei50042\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei50042\crypto\math\_modexp.pyd
- %TEMP%\_mei50042\crypto\hash\_poly1305.pyd
- %TEMP%\_mei50042\pythonwin\mfc140u.dll
- nul
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'ip##fo.io':443
- 'localhost':49719
TCP
Other
- 'ra#.####ubusercontent.com':443
- 'ip##fo.io':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAcc...' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
- '<SYSTEM32>\cmd.exe' /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAcc...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -Enabl...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -ExclusionExtension '.exe'"
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
- '<SYSTEM32>\reg.exe' QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
- '<SYSTEM32>\reg.exe' QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
