Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im powershell.exe
Launches a large number of processes
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Çý¶¯ÈËÉúרɱ'
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc stop Ddriver
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\drivers\\' and FileName = 'svchost' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\drivers\\' and FileName = 'svchost' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive = 'c:' and Path = '\\windows\\temp\\' and FileName = 'svchost' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive = 'c:' and Path = '\\windows\\temp\\' and FileName = 'svchost' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive = 'c:' and Path = '\\windows\\temp\\' and FileName = 'mkatz' and Extension = 'ini'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive = 'c:' and Path = '\\windows\\temp\\' and FileName = 'mkatz' and Extension = 'ini'" call delete
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive='c:' and Path = '\\windows\\temp\\' and FileName = 'm' and Extension = 'ps1'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive='c:' and Path = '\\windows\\temp\\' and FileName = 'm' and Extension = 'ps1'" call delete
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive='c:' and Path = '\\windows\\temp\\' and FileName = 'updater' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\drivers\\' and FileName = 'taskmgr' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\drivers\\' and FileName = 'taskmgr' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\temp\\svchost.exe'" call Terminate
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "name='updater.exe' and ExecutablePath='C:\\Windows\\temp\\updater.exe'" call Terminate
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "name='updater.exe' and ExecutablePath='C:\\Windows\\temp\\updater.exe'" call Terminate
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "name='wmiex.exe'" call Terminate
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "name='wmiex.exe'" call Terminate
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "name='taskmgr.exe' and ExecutablePath='C:\\WINDOWS\\SysWOW64\\drivers\\taskmgr.exe'" call Terminate
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "name='taskmgr.exe' and ExecutablePath='C:\\WINDOWS\\SysWOW64\\drivers\\taskmgr.exe'" call Terminate
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\windows\\SysWOW64\\drivers\\svchost.exe'" call Terminate
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "name='svchost.exe' and ExecutablePath='C:\\windows\\SysWOW64\\drivers\\svchost.exe'" call Terminate
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive='c:' and Path = '\\windows\\temp\\' and FileName = 'updater' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "Autoscan"
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\' and FileName = 'wmiex' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "90-C2-7E-53-EC-30"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "90-C2-7E-53-EC-30"
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\Windows\90-C2-7E-53-EC-30" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "\Microsoft\Windows\90-C2-7E-53-EC-30" /f
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "\Microsoft\Windows\90-C2-7E-53-EC-30"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "\Microsoft\Windows\90-C2-7E-53-EC-30"
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Credentials" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "Credentials" /f
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "Credentials"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "Credentials"
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\Credentials" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "\Microsoft\Credentials" /f
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "\Microsoft\Credentials"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "\Microsoft\Credentials"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im powershell.exe
- '%WINDIR%\syswow64\netsh.exe' interface portproxy delete v4tov4 listenport=65532
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface portproxy delete v4tov4 listenport=65532
- '%WINDIR%\syswow64\netsh.exe' interface portproxy delete v4tov4 listenport=65531
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface portproxy delete v4tov4 listenport=65531
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\' and FileName = 'svhost' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c wmic datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\' and FileName = 'svhost' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\windows\Bluetooths" /f
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\temp\\svchost.exe'" call Terminate
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "\Microsoft\windows\Bluetooths" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "WebServers" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "WebServers" /f
- '%WINDIR%\syswow64\sc.exe' delete WebServers
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "Ddrivers"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "Ddrivers"
- '%WINDIR%\syswow64\net1.exe' user k8h3d /del
- '%WINDIR%\syswow64\net.exe' user k8h3d /del
- '%WINDIR%\syswow64\cmd.exe' /c net user k8h3d /del
- '%WINDIR%\syswow64\sc.exe' delete DnsScan
- '%WINDIR%\syswow64\cmd.exe' /c sc delete DnsScan
- '%WINDIR%\syswow64\sc.exe' stop DnsScan
- '%WINDIR%\syswow64\cmd.exe' /c sc stop DnsScan
- '%WINDIR%\syswow64\cmd.exe' /c sc delete WebServers
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "DnsScan"
- '%WINDIR%\syswow64\sc.exe' stop WebServers
- '%WINDIR%\syswow64\cmd.exe' /c sc stop WebServers
- '%WINDIR%\syswow64\sc.exe' delete RemComSvc
- '%WINDIR%\syswow64\cmd.exe' /c sc delete RemComSvc
- '%WINDIR%\syswow64\sc.exe' stop RemComSvc
- '%WINDIR%\syswow64\cmd.exe' /c sc stop RemComSvc
- '%WINDIR%\syswow64\sc.exe' delete Ddriver
- '%WINDIR%\syswow64\cmd.exe' /c sc delete Ddriver
- '%WINDIR%\syswow64\sc.exe' stop Ddriver
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "90-C2-7E-53-EC-30" /f
- '%WINDIR%\syswow64\wbem\wmic.exe' datafile where "drive = 'c:' and Path = '\\windows\\SysWOW64\\' and FileName = 'wmiex' and Extension = 'exe'" call delete
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "Autoscan"
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "Autocheck"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "DnsScan"
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Bluetooths" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "Bluetooths" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "net restart" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "net restart" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Autocheck" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "Autocheck" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Autostart" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "Autostart" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Autoscan" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "Autoscan" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "DnsScan" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "DnsScan" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Ddrivers" /f
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn "Ddrivers" /f
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "\Microsoft\windows\Bluetooths"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "\Microsoft\windows\Bluetooths"
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "net restart"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "net restart"
- '%WINDIR%\syswow64\schtasks.exe' /End /tn "Autostart"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "Autostart"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /End /tn "Autocheck"
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "90-C2-7E-53-EC-30" /f
