Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\KTTNXFKO] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\KTTNXFKO] 'ImagePath' = '%ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\hoouyqjqqvyx.sys'
Creates the following services
- 'KTTNXFKO' %ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\hoouyqjqqvyx.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Event Logging
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- <PATH_SAMPLE>_packed.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %APPDATA%\microsoft\telemetry\win_services_host.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>_packed.exe.log
- %ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe
- %WINDIR%\temp\__psscriptpolicytest_k2tz3my3.q3c.ps1
- %WINDIR%\temp\__psscriptpolicytest_1knfpyxz.hyi.psm1
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-50-747.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-50-948.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-017.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-133.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-149.dump
- %WINDIR%\temp\__psscriptpolicytest_uywtstpm.orp.ps1
- %WINDIR%\temp\__psscriptpolicytest_vxyaiuj2.2rt.psm1
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-265.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-296.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-334.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-403.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-481.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-551.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-646.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-680.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-700.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-719.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-739.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-760.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-51-781.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-091.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-122.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-153.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-160.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-191.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-207.dump
- %WINDIR%\temp\content\1216-2620-powershell.exe-16-49-52-254.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\hoouyqjqqvyx.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_k2tz3my3.q3c.ps1
- %WINDIR%\temp\__psscriptpolicytest_1knfpyxz.hyi.psm1
- %WINDIR%\temp\__psscriptpolicytest_uywtstpm.orp.ps1
- %WINDIR%\temp\__psscriptpolicytest_vxyaiuj2.2rt.psm1
Network activity
Connects to
- 'gi##.###hubusercontent.com':443
- 'x1.#.lencr.org':80
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'po##.#ashvault.pro':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'gi##.###hubusercontent.com':443
- 'gi##ub.com':443
- 'po##.#ashvault.pro':443
UDP
- DNS ASK gi##.###hubusercontent.com
- DNS ASK x1.#.lencr.org
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK po##.#ashvault.pro
Miscellaneous
Creates and executes the following
- '<PATH_SAMPLE>_packed.exe'
- '%APPDATA%\microsoft\telemetry\win_services_host.exe'
- '%ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' delete "KTTNXFKO"
- '<SYSTEM32>\sc.exe' create "KTTNXFKO" binpath= "%ALLUSERSPROFILE%\cbkhjncoaipz\uvukzsqjyugh.exe" start= "auto"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\sc.exe' start "KTTNXFKO"
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\svchost.exe'
