Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Update' = '%PROGRAMDATA%\HdcpHandlerDLL\DriverHost.exeDriverHost.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system update.url
- <SYSTEM32>\tasks\driverupdater
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%PROGRAMDATA%\HdcpHandlerDLL\WinRing0x64.sys'
Modifies file system
Creates the following files
- %TEMP%\build1.exe
- %TEMP%\ionic.zip.dll
- %PROGRAMDATA%\hdcphandlerdll\zip.zip
- %PROGRAMDATA%\hdcphandlerdll\nvrtc64_100_0.dll.tmp
- %PROGRAMDATA%\hdcphandlerdll\nvrtc-builtins64_100.dll.tmp
- %PROGRAMDATA%\hdcphandlerdll\xmrig-cuda.dll.tmp
- %PROGRAMDATA%\hdcphandlerdll\hostupdater.exe.tmp
- %PROGRAMDATA%\hdcphandlerdll\ionic.zip.dll.tmp
- %PROGRAMDATA%\hdcphandlerdll\driverhost.exe
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\hdcphandlerdll\hostupdater.exe
- %PROGRAMDATA%\hdcphandlerdll\driverhost.exe
- %PROGRAMDATA%\hdcphandlerdll\nvrtc64_100_0.dll
- %PROGRAMDATA%\hdcphandlerdll\nvrtc-builtins64_100.dll
- %PROGRAMDATA%\hdcphandlerdll\xmrig-cuda.dll
- %PROGRAMDATA%\hdcphandlerdll\ionic.zip.dll
Deletes the following files
- %PROGRAMDATA%\hdcphandlerdll\zip.zip
Moves the following files
- from %PROGRAMDATA%\hdcphandlerdll\nvrtc64_100_0.dll.tmp to %PROGRAMDATA%\hdcphandlerdll\nvrtc64_100_0.dll
- from %PROGRAMDATA%\hdcphandlerdll\nvrtc-builtins64_100.dll.tmp to %PROGRAMDATA%\hdcphandlerdll\nvrtc-builtins64_100.dll
- from %PROGRAMDATA%\hdcphandlerdll\xmrig-cuda.dll.tmp to %PROGRAMDATA%\hdcphandlerdll\xmrig-cuda.dll
- from %PROGRAMDATA%\hdcphandlerdll\hostupdater.exe.tmp to %PROGRAMDATA%\hdcphandlerdll\hostupdater.exe
- from %PROGRAMDATA%\hdcphandlerdll\ionic.zip.dll.tmp to %PROGRAMDATA%\hdcphandlerdll\ionic.zip.dll
Network activity
TCP
- 'xm#.###l.minergate.com':45700
UDP
- DNS ASK xm#.###l.minergate.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\build1.exe'
- '%PROGRAMDATA%\hdcphandlerdll\driverhost.exe'
- '%PROGRAMDATA%\hdcphandlerdll\hostupdater.exe' --donate-level 1 -o xmr.pool.minergate.com:45700 -u AlmightySemion.Work@pm.me -p x -k --cuda -a randomx
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 1 /tn "DriverUpdater" /tr "%PROGRAMDATA%\HdcpHandlerDLL\DriverHost.exe" /f' (with hidden window)
- '%PROGRAMDATA%\hdcphandlerdll\driverhost.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 1 /tn "DriverUpdater" /tr "%PROGRAMDATA%\HdcpHandlerDLL\DriverHost.exe" /f
- '<SYSTEM32>\taskeng.exe' {F3891670-E464-434F-BED1-80C81D59CD3A} S-1-5-21-1960123792-2022915161-3775307078-1001:msowhnqa\user:Interactive:[1]
