Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'RuntimeBroker' = '"%APPDATA%\Microsoft\WindowsApps\RuntimeBroker.exe"'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RuntimeBroker' = '"%APPDATA%\Microsoft\WindowsApps\RuntimeBroker.exe"'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\pacjsworker.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\caches\stub_exe.dat
- %TEMP%\brightinfo\cache\stub_exe.dat
- %APPDATA%\microsoft\windowsapps\runtimebroker.exe
- %TEMP%\7afe1c7b02f8.tmp
- %TEMP%\0ec8fe6340c6.tmp
- %TEMP%\cfb173c57f2a.tmp
- %TEMP%\647f24e54023.tmp
- %LOCALAPPDATA%\windowstelemetry\installed.dat
- %TEMP%\b126f4538f82.tmp
- %TEMP%\ded99258a61c.tmp
- %WINDIR%\microsoft.net\framework64\v4.0.30319\xor.log
- %WINDIR%\servicestate\winhttpautoproxysvc\data\527939714.cache
- %TEMP%\6c19475f3b4d.tmp
- %TEMP%\3dc77b3cc34b.tmp
- %TEMP%\b7665e636de7.tmp
- %TEMP%\a59a121ec063.tmp
- %TEMP%\85997f8ab44c.tmp
- %TEMP%\aa146a89cdf9.tmp
- %TEMP%\92a00ea6db1c.tmp
- %TEMP%\2f3d51fdb0f9.tmp
- %TEMP%\567edb54f162.tmp
- %TEMP%\c192620ec6c1.tmp
- %TEMP%\779c39d487fe.tmp
- %TEMP%\183070a177b2.tmp
- %TEMP%\b800654598ec.tmp
- %TEMP%\199b942f9e52.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windowsapps\runtimebroker.exe
- %TEMP%\7afe1c7b02f8.tmp
- %TEMP%\0ec8fe6340c6.tmp
- %TEMP%\cfb173c57f2a.tmp
- %TEMP%\647f24e54023.tmp
- %LOCALAPPDATA%\windowstelemetry\installed.dat
- %TEMP%\b126f4538f82.tmp
- %TEMP%\ded99258a61c.tmp
- %TEMP%\6c19475f3b4d.tmp
- %TEMP%\3dc77b3cc34b.tmp
- %TEMP%\b7665e636de7.tmp
- %TEMP%\a59a121ec063.tmp
- %TEMP%\85997f8ab44c.tmp
- %TEMP%\aa146a89cdf9.tmp
- %TEMP%\92a00ea6db1c.tmp
- %TEMP%\2f3d51fdb0f9.tmp
- %TEMP%\567edb54f162.tmp
- %TEMP%\c192620ec6c1.tmp
- %TEMP%\779c39d487fe.tmp
- %TEMP%\183070a177b2.tmp
- %TEMP%\b800654598ec.tmp
- %TEMP%\199b942f9e52.tmp
Deletes following files that it created itself
- %TEMP%\7afe1c7b02f8.tmp
- %TEMP%\0ec8fe6340c6.tmp
- %TEMP%\cfb173c57f2a.tmp
- %TEMP%\647f24e54023.tmp
- %TEMP%\b126f4538f82.tmp
- %TEMP%\ded99258a61c.tmp
- %TEMP%\6c19475f3b4d.tmp
- %TEMP%\3dc77b3cc34b.tmp
- %TEMP%\b7665e636de7.tmp
- %TEMP%\a59a121ec063.tmp
- %TEMP%\85997f8ab44c.tmp
- %TEMP%\aa146a89cdf9.tmp
- %TEMP%\92a00ea6db1c.tmp
- %TEMP%\2f3d51fdb0f9.tmp
- %TEMP%\567edb54f162.tmp
- %TEMP%\c192620ec6c1.tmp
- %TEMP%\779c39d487fe.tmp
- %TEMP%\183070a177b2.tmp
- %TEMP%\b800654598ec.tmp
- %TEMP%\199b942f9e52.tmp
Network activity
Connects to
- '21#.#0.102.3':4521
- 'ip##pi.com':80
- '93.##2.224.190':9000
TCP
HTTP GET requests
- http://ip##pi.com/json/
- http://93.###.224.190:9000/proxy.pac via 93.##2.224.190
Other
- '21#.#0.102.3':4521
UDP
- DNS ASK ip##pi.com
Miscellaneous
Adds a root certificate
Modifies value of AutoConfigURL parameter to 'http://93.152.224.190:9000/proxy.pac'
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\7afe1c7b02f8.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\0ec8fe6340c6.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\cfb173c57f2a.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\647f24e54023.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\b126f4538f82.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\ded99258a61c.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\6c19475f3b4d.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\3dc77b3cc34b.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\b7665e636de7.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\a59a121ec063.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\85997f8ab44c.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\aa146a89cdf9.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\92a00ea6db1c.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\2f3d51fdb0f9.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\567edb54f162.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\c192620ec6c1.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\779c39d487fe.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\183070a177b2.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\b800654598ec.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\199b942f9e52.tmp"
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe'
- '<SYSTEM32>\wbem\wmic.exe' process where ProcessId=3364 get CommandLine /value
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe'
- '<SYSTEM32>\pacjsworker.exe' 98599f0f-4d57-4b52-a1d6-f1fe48dbb0be b1723078-d28e-46eb-9dd0-fd590593e881
- '<SYSTEM32>\pacjsworker.exe' 16d34771-2122-4aef-8768-6475ca93e542 b1723078-d28e-46eb-9dd0-fd590593e881
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\38fb8567fd02.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\74654bd13acb.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\a8212221fae6.tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\e442639d5d85.tmp"
