Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityHealthService' = '"C:\Recovery\WindowsRE\SecurityHealthService.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityHealthService' = '"C:\Recovery\WindowsRE\SecurityHealthService.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Recovery\WindowsRE\SecurityHealthService.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhostw' = '"%WINDIR%\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\taskhostw.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhostw' = '"%WINDIR%\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\taskhostw.exe"'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Recovery\WindowsRE\SecurityHealthService.exe", "%WINDIR%\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'powershell' = '"C:\Recovery\WindowsRE\powershell.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'powershell' = '"C:\Recovery\WindowsRE\powershell.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'powershell' = '"C:\kms\powershell.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'powershell' = '"C:\kms\powershell.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\securityhealthservices
- <SYSTEM32>\tasks\securityhealthservice
- <SYSTEM32>\tasks\taskhostwt
- <SYSTEM32>\tasks\taskhostw
- <SYSTEM32>\tasks\powershellp
- <SYSTEM32>\tasks\powershell
- <SYSTEM32>\tasks\<File name>n
- <SYSTEM32>\tasks\<File name>
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/rcczi/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Patches code
in dll
- nieh.exe process, KERNEL32.dll module
- powershell.exe process, KERNEL32.dll module
Modifies file system
Creates the following files
- <Current directory>\5ad1d373cb165b
- C:\recovery\windowsre\powershell.exe
- C:\recovery\windowsre\e978f868350d50
- C:\kms\powershell.exe
- C:\kms\e978f868350d50
- %WINDIR%\softwaredistribution\sls\2b81f1bf-356c-4fa1-90f1-7581a62c6764\taskhostw.exe
- %WINDIR%\softwaredistribution\sls\2b81f1bf-356c-4fa1-90f1-7581a62c6764\ea9f0e6c9e2dcd
- C:\recovery\windowsre\securityhealthservice.exe
- C:\recovery\windowsre\926e3e4b62361b
- %TEMP%\dce32d8a11a9b11255db29ddfbd479d4ed307d38
- %TEMP%\content\2796-2632-<File name>.exe-16-12-15-274.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-27-255.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-28-456.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-30-496.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-31-438.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-32-738.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-34-235.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-35-300.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-36-475.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-36-976.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-37-225.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-40-651.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-41-884.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-47-309.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-51-110.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-52-023.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-53-972.dump
- %TEMP%\content\2796-2632-<File name>.exe-16-12-54-905.dump
- %TEMP%\igaw7tdyqn
- %TEMP%\xinezssaxy.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- nul
- %HOMEPATH%\desktop\artevrim.log
- %HOMEPATH%\desktop\fkavwfza.log
- %HOMEPATH%\desktop\epfathzd.log
Deletes following files that it created itself
- %TEMP%\igaw7tdyqn
Network activity
UDP
- DNS ASK ze######ma.temp.swtest.ru
Miscellaneous
Creates and executes the following
- 'C:\recovery\windowsre\powershell.exe'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/kms/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/rcczi/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- 'C:\recovery\windowsre\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SecurityHealthService.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SecurityHealthService.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SecurityHealthService.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'%WINDIR%\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\taskhostw.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostw" /sc ONLOGON /tr "'%WINDIR%\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\taskhostw.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'%WINDIR%\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\taskhostw.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\kms\powershell.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershell" /sc ONLOGON /tr "'C:\kms\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\kms\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>n" /sc MINUTE /mo 7 /tr "'<Full path to file>'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>n" /sc MINUTE /mo 13 /tr "'<Full path to file>'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\xinEzssAxY.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\8MPHA9c1U6.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\xinEzssAxY.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\8MPHA9c1U6.bat"' (with hidden window)
