Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TaiDgtf' = '"<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%TEMP%\km25zet...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsHealthMonitor' = '%APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '%APPDATA%\Microsoft\Windows\Themes\ThemeSync.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Setup' = '%APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\onedrivestandalone
- %APPDATA%\microsoft\windows\start menu\programs\startup\onedrive.lnk
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
Injects code into
the following user processes:
- onedriveupdate.exe
Modifies file system
Creates the following files
- %TEMP%\content\3360-3876-<File name>.exe-15-01-57-531.dump
- %TEMP%\content\3360-3876-<File name>.exe-15-02-16-931.dump
- %APPDATA%\taidgtf.exe
- %TEMP%\km25zetjzhj.ps1
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %APPDATA%\microsoft\windows\sendto\onedriveupdate.exe
- %APPDATA%\microsoft\windows\themes\syshelper.vbs
- %TEMP%\content\4984-1120-onedriveupdate.exe-15-02-46-481.dump
- %TEMP%\content\488-4620-onedriveupdate.exe-15-02-46-511.dump
- %TEMP%\content\4984-1120-onedriveupdate.exe-15-03-05-876.dump
- %TEMP%\content\488-4620-onedriveupdate.exe-15-03-05-898.dump
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\onedriveupdate.exe.log
Sets the 'hidden' attribute to the following files
- %APPDATA%\taidgtf.exe
- %APPDATA%\microsoft\windows\sendto\onedriveupdate.exe
- %APPDATA%\microsoft\windows\themes\syshelper.vbs
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' //nologo //b %APPDATA%\Microsoft\Windows\Themes\syshelper.vbs
- '%APPDATA%\microsoft\windows\sendto\onedriveupdate.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\attrib.exe' +H %APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d %APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d %APPDATA%\Microsoft\Windows\Themes\ThemeSync.exe /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d %APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.Targe...
- '<SYSTEM32>\attrib.exe' +H %APPDATA%\Microsoft\Windows\Themes\syshelper.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\SendTo\OneDriveUpdate.exe"' (with hidden window)
