Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\wyiqgsvp.sys'
Creates the following services
- 'Micorsoft Windows Service' %TEMP%\wyiqgsvp.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Patches code
in NTDLL dll
- zajhhye.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\hpfefxcj.exe
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69bf406d-1464.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69bf4071-c18.pma
- %TEMP%\wyiqgsvp.sys
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
Deletes following files that it created itself
- %TEMP%\wyiqgsvp.sys
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Network activity
UDP
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Creates and executes the following
- '%TEMP%\hpfefxcj.exe' elevate
- '%TEMP%\hpfefxcj.exe' admin
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%ProgramFiles%\internet explorer\iexplore.exe'
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\bho\ie_to_edge_stub.exe' --from-ie-to-edge=3 --ie-frame-hwnd=1301a2
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=1301a2
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=1301a2 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\hpfefxcj.exe"" admin
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=1301a2 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\hpfefxcj.exe"" admin' (with hidden window)
