Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\proxy
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:8080'
Modifies file system
Creates the following files
- %TEMP%\onefile_5004_134046933733703688\proxy.dll
- %TEMP%\onefile_5004_134046933733703688\_asyncio.pyd
- %TEMP%\onefile_5004_134046933733703688\_brotli.pyd
- %TEMP%\onefile_5004_134046933733703688\_bz2.pyd
- %TEMP%\onefile_5004_134046933733703688\_cffi_backend.pyd
- %TEMP%\onefile_5004_134046933733703688\_ctypes.pyd
- %TEMP%\onefile_5004_134046933733703688\_decimal.pyd
- %TEMP%\onefile_5004_134046933733703688\_hashlib.pyd
- %TEMP%\onefile_5004_134046933733703688\_lzma.pyd
- %TEMP%\onefile_5004_134046933733703688\_multiprocessing.pyd
- %TEMP%\onefile_5004_134046933733703688\_overlapped.pyd
- %TEMP%\onefile_5004_134046933733703688\_queue.pyd
- %TEMP%\onefile_5004_134046933733703688\_ruamel_yaml.pyd
- %TEMP%\onefile_5004_134046933733703688\_socket.pyd
- %TEMP%\onefile_5004_134046933733703688\_ssl.pyd
- %TEMP%\onefile_5004_134046933733703688\_uuid.pyd
- %TEMP%\onefile_5004_134046933733703688\libcrypto-1_1.dll
- %TEMP%\onefile_5004_134046933733703688\libffi-7.dll
- %TEMP%\onefile_5004_134046933733703688\libssl-1_1.dll
- %TEMP%\onefile_5004_134046933733703688\pyexpat.pyd
- %TEMP%\onefile_5004_134046933733703688\python3.dll
- %TEMP%\onefile_5004_134046933733703688\python39.dll
- %TEMP%\onefile_5004_134046933733703688\select.pyd
- %TEMP%\onefile_5004_134046933733703688\unicodedata.pyd
- %TEMP%\onefile_5004_134046933733703688\vcruntime140.dll
- %TEMP%\onefile_5004_134046933733703688\vcruntime140_1.dll
- %TEMP%\onefile_5004_134046933733703688\certifi\cacert.pem
- %TEMP%\onefile_5004_134046933733703688\charset_normalizer\md.pyd
- %TEMP%\onefile_5004_134046933733703688\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_5004_134046933733703688\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\onefile_5004_134046933733703688\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\_elementpath.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\builder.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\etree.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\objectify.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\sax.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\html\_difflib.pyd
- %TEMP%\onefile_5004_134046933733703688\lxml\html\diff.pyd
- %TEMP%\onefile_5004_134046933733703688\markupsafe\_speedups.pyd
- %TEMP%\onefile_5004_134046933733703688\mitmproxy_wireguard\mitmproxy_wireguard.pyd
- %TEMP%\onefile_5004_134046933733703688\msgpack\_cmsgpack.pyd
- %TEMP%\onefile_5004_134046933733703688\tornado\speedups.pyd
- %TEMP%\onefile_5004_134046933733703688\zstandard\_cffi.pyd
- %TEMP%\onefile_5004_134046933733703688\zstandard\backend_c.pyd
- %HOMEPATH%\.mitmproxy\mitmproxy-ca.pem
- %HOMEPATH%\.mitmproxy\mitmproxy-ca.p12
- %HOMEPATH%\.mitmproxy\mitmproxy-ca-cert.pem
- %HOMEPATH%\.mitmproxy\mitmproxy-ca-cert.cer
- %HOMEPATH%\.mitmproxy\mitmproxy-ca-cert.p12
- %HOMEPATH%\.mitmproxy\mitmproxy-dhparam.pem
- nul
Network activity
Connects to
- '19#.#0.205.172':5000
- 'localhost':8080
- 'localhost':49699
TCP
HTTP POST requests
- http://19#.##.205.172:5000/send_notify_2 via 19#.#0.205.172
Miscellaneous
Adds a root certificate
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /RL HIGHEST /TN proxy /TR \"<Full path to file>\" /F
- '<SYSTEM32>\cmd.exe' /c "certutil -addstore "Root" "%HOMEPATH%\.mitmproxy\mitmproxy-ca-cert.pem""
- '<SYSTEM32>\certutil.exe' -addstore "Root" "%HOMEPATH%\.mitmproxy\mitmproxy-ca-cert.pem"
- '<SYSTEM32>\cmd.exe' /c "certutil -addstore "Root" "%HOMEPATH%\.mitmproxy\mitmproxy-ca-cert.pem""' (with hidden window)
