Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Update Service' = '%APPDATA%\WindowsDefender\WindowsDefender\svchost.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Update Service' = '%APPDATA%\WindowsDefender\WindowsDefender\svchost.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices] 'Windows Update Service' = '%APPDATA%\WindowsDefender\WindowsDefender\svchost.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Windows Update Service' = '%APPDATA%\WindowsDefender\WindowsDefender\svchost.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Update Service' = '%APPDATA%\WindowsDefender\WindowsDefender\svchost.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows update service.lnk
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Windows Update Service] 'ImagePath' = '%APPDATA%\WindowsDefender\WindowsDefender\svchost.exe'
Creates the following services
- 'Windows Update Service' %APPDATA%\WindowsDefender\WindowsDefender\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\msi89d7.tmp
- %APPDATA%\windowsdefender\windowsdefender\msedge_elf.dll
- %APPDATA%\windowsdefender\windowsdefender\svchost.exe
- %TEMP%\etilqs_whlpv2w6bzdiadi
- %TEMP%\etilqs_uwg8ryse6b7biyx
- %TEMP%\etilqs_8vzurixjqqenf2g
- %TEMP%\etilqs_qvr3ismsvy9hxec
- %TEMP%\etilqs_zos62z198r8ruhj
- %TEMP%\etilqs_dg8jvrm2qtcmqtq
- %TEMP%\etilqs_9gvs20mgcrlivdi
- %TEMP%\etilqs_vdsyw2m64dgt5s8
- %TEMP%\etilqs_zlebdgw300sz3ma
- %TEMP%\etilqs_xesutktsvs3ts9n
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
- %LOCALAPPDATA%\microsoft\windows\usrclass.dat
Network activity
Connects to
- '24.##2.37.98':60000
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK ip##pi.com
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK am##on.com
- DNS ASK du###uckgo.com
- DNS ASK bing.com
- DNS ASK re###.opera.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK si#####ck2.opera.com
- DNS ASK me####olivre.com.br
Miscellaneous
Searches for the following windows
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Creates and executes the following
- '%APPDATA%\windowsdefender\windowsdefender\svchost.exe'
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\MSI89D7.tmp
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.mercadolivre.com.br/"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.mercadolivre.com.br/
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.mercadolivre.com.br/ /crash-reporter-parent-id=1892
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1892.0.1011427965\194683083" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.4.1856402512\279947675" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.5.1378862628\1492548021" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.6.605612517\1894682196" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.7.535902068\834236022" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.8.1896471791\1185363236" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.9.1110599471\51882650" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1892.10.894554829\358396513" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1892.4.1856402512\279947675" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2248
