Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Creates the following files
- %APPDATA%\browser\myuiqw.exe
Miscellaneous
Creates and executes the following
- '%APPDATA%\browser\myuiqw.exe'
- '<SYSTEM32>\cmd.exe' sc stop WinDefend' (with hidden window)
- '<SYSTEM32>\cmd.exe' sc delete WinDefend' (with hidden window)
- '<SYSTEM32>\cmd.exe' powershell Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' sc stop WinDefend
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' sc delete WinDefend
- '<SYSTEM32>\cmd.exe' powershell Set-MpPreference -DisableRealtimeMonitoring $true
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
- '<SYSTEM32>\sc.exe' delete WinDefend
