Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows protection
Modifies file system
Creates the following files
- %TEMP%\autb36.tmp
- %ALLUSERSPROFILE%\defender\task.vbs
- %TEMP%\autd54.tmp
- %ALLUSERSPROFILE%\defender\timeout.ps1
- %TEMP%\autd74.tmp
- %ALLUSERSPROFILE%\defender\windef.bat
- %TEMP%\autdb3.tmp
- %ALLUSERSPROFILE%\task host\svchost.exe
- %ALLUSERSPROFILE%\defender\windows protection.exe
- nul
- %TEMP%\aut1100.tmp
- %ALLUSERSPROFILE%\defender\winring0x64.sys
- %TEMP%\aut112f.tmp
- %ALLUSERSPROFILE%\defender\start.exe
- %TEMP%\aut117e.tmp
- %ALLUSERSPROFILE%\defender\start.vbs
- %LOCALAPPDATA%\tempscratch.bat
- %TEMP%\autd24.tmp
- %TEMP%\aute6f.tmp
- %ALLUSERSPROFILE%\defender\task.bat
- %TEMP%\autc05.tmp
- %ALLUSERSPROFILE%\defender\advancedrun.exe
- %TEMP%\autb76.tmp
- %ALLUSERSPROFILE%\defender\config.json
- %TEMP%\autba5.tmp
- %ALLUSERSPROFILE%\defender\def.bat
- %TEMP%\autbd5.tmp
- %ALLUSERSPROFILE%\defender\def.vbs
- %ALLUSERSPROFILE%\defender\kill.bat
- %ALLUSERSPROFILE%\defender\switch.bat
- %TEMP%\autc35.tmp
- %ALLUSERSPROFILE%\defender\kill.vbs
- %TEMP%\autc65.tmp
- %ALLUSERSPROFILE%\defender\prot.vbs
- %TEMP%\autc94.tmp
- %ALLUSERSPROFILE%\defender\switch.vbs
- %TEMP%\autcb5.tmp
- %TEMP%\autcf4.tmp
- %TEMP%\8cd4.tmp\8cd5.tmp\8cd6.bat
Deletes the following files
- %TEMP%\autb36.tmp
- %TEMP%\aut112f.tmp
- %TEMP%\aut1100.tmp
- %TEMP%\aute6f.tmp
- %TEMP%\autdb3.tmp
- %TEMP%\autd74.tmp
- %TEMP%\autd54.tmp
- %TEMP%\autd24.tmp
- %TEMP%\aut117e.tmp
- %TEMP%\autcf4.tmp
- %TEMP%\autc94.tmp
- %TEMP%\autc65.tmp
- %TEMP%\autc35.tmp
- %TEMP%\autc05.tmp
- %TEMP%\autbd5.tmp
- %TEMP%\autba5.tmp
- %TEMP%\autb76.tmp
- %TEMP%\autcb5.tmp
- %TEMP%\8cd4.tmp\8cd5.tmp\8cd6.bat
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Defender\def.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Defender\task.vbs"
- '%ALLUSERSPROFILE%\defender\advancedrun.exe' /EXEFilename "%ALLUSERSPROFILE%\Defender\Windef.bat" /WindowState 0 /RunAs 8 /Run
- '%ALLUSERSPROFILE%\defender\advancedrun.exe' /SpecialRun 4101d8 2068
- '%WINDIR%\syswow64\cscript.exe' %ALLUSERSPROFILE%\Defender\Start.vbs
- '%ALLUSERSPROFILE%\defender\start.exe'
- '<SYSTEM32>\cscript.exe' "%ALLUSERSPROFILE%\Defender\switch.vbs"
- '%ALLUSERSPROFILE%\task host\svchost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy Unrestricted %ALLUSERSPROFILE%\Defender\timeout.ps1
- '%WINDIR%\syswow64\cmd.exe' /c %LOCALAPPDATA%\Tempscratch.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\def.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\task.bat" "' (with hidden window)
- '%ALLUSERSPROFILE%\defender\start.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\8CD4.tmp\8CD5.tmp\8CD6.bat %ALLUSERSPROFILE%\Defender\Start.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\switch.bat" "' (with hidden window)
- '%ALLUSERSPROFILE%\task host\svchost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %LOCALAPPDATA%\Tempscratch.bat
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\def.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\task.bat" "
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN "Windows Protection" /TR "%ALLUSERSPROFILE%\Defender\Start.exe" /f
- '%WINDIR%\syswow64\ping.exe' -n 0127.0.0.1
- '%WINDIR%\syswow64\timeout.exe' /T 10
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\8CD4.tmp\8CD5.tmp\8CD6.bat %ALLUSERSPROFILE%\Defender\Start.exe"
- '<SYSTEM32>\timeout.exe' /T 30
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\switch.bat" "
