Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNOTIFY.EXE] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UsoClient.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MusNotification.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdateAssistant.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINDOWS10UPGRADERAPP.EXE] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\remsh.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SIHClient.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstallAgent.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaaSMedic.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WaasMedicAgent.exe] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MUSNOTIFICATIONUX.EXE] 'Debugger' = '*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UPFC.EXE] 'Debugger' = '*'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\SU10Guard] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SU10Guard] 'ImagePath' = '%WINDIR%\UPDATE\SU10Guard.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\wuauserv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WaasMedicSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\USOSVC] 'Start' = '00000002'
Creates the following services
- 'SU10Guard' %WINDIR%\UPDATE\SU10Guard.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Modifies file system
Creates the following files
- %WINDIR%\update\diskmgmt.msc
- %WINDIR%\update\lang\ukrainian\wu.nat
- %WINDIR%\update\stopupdates10w.ini
- %WINDIR%\update\translate\change-from-234-to-250.upd
- %WINDIR%\update\translate\change-from-250-to-255.upd
- %WINDIR%\update\translate\change-from-255-to-300.upd
- %WINDIR%\update\translate\change-from-300-to-350.upd
- %WINDIR%\update\translate\how_to_translate.txt
- %WINDIR%\update\translate\stopupdates10.nat
- %WINDIR%\update\translate\wu.nat
- %WINDIR%\update\discan.dll
- %WINDIR%\update\diskpart.exe
- %WINDIR%\update\diskperf.exe
- %WINDIR%\update\diskraid.exe
- %WINDIR%\update\diskshadow.exe
- %WINDIR%\update\disksnapshot.exe
- %WINDIR%\update\dism.exe
- %WINDIR%\update\h8hxwxhf.exe
- %WINDIR%\update\stopupdates10.exe
- %WINDIR%\update\su10guard.exe
- %WINDIR%\update\wu.exe
- %WINDIR%\update\stopupdates10log.txt
- %WINDIR%\update\lang\ukrainian\stopupdates10.nat
- %WINDIR%\update\su10guard.log
- %WINDIR%\update\lang\turkish\stopupdates10.nat
- %WINDIR%\update\lang\spanish\stopupdates10.nat
- %WINDIR%\update\disksnapshot.conf
- %WINDIR%\update\h8hxwxhf.cfg
- %WINDIR%\update\lang\arabic\stopupdates10.nat
- %WINDIR%\update\lang\brazilianportuguese\stopupdates10.nat
- %WINDIR%\update\lang\bulgarian\stopupdates10.nat
- %WINDIR%\update\lang\catalan\stopupdates10.nat
- %WINDIR%\update\lang\chinesetraditional\stopupdates10.nat
- %WINDIR%\update\lang\czech\stopupdates10.nat
- %WINDIR%\update\lang\czech2\stopupdates10.nat
- %WINDIR%\update\lang\french\stopupdates10.nat
- %WINDIR%\update\lang\german\stopupdates10.nat
- %WINDIR%\update\lang\greek\stopupdates10.nat
- %WINDIR%\update\lang\greek\wu.nat
- %WINDIR%\update\lang\hungarian\stopupdates10.nat
- %WINDIR%\update\lang\italian\stopupdates10.nat
- %WINDIR%\update\lang\japanese\stopupdates10.nat
- %WINDIR%\update\lang\japanese_meiryo\stopupdates10.nat
- %WINDIR%\update\lang\korean\stopupdates10.nat
- %WINDIR%\update\lang\polish\stopupdates10.nat
- %WINDIR%\update\lang\russian\stopupdates10.nat
- %WINDIR%\update\lang\russian\wu.nat
- %WINDIR%\update\lang\spanish2\stopupdates10.nat
- %TEMP%\7zsfx000.cmd
Deletes the following files
- %WINDIR%\update\su10guard.log
- %TEMP%\7zsfx000.cmd
Substitutes the following files
- %WINDIR%\update\su10guard.log
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\update\stopupdates10.exe' /disable
- '%WINDIR%\update\su10guard.exe' -i
- '%WINDIR%\update\su10guard.exe'
- '%WINDIR%\update\h8hxwxhf.exe' /Run
- '%WINDIR%\update\su10guard.exe' -i' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C ping 127.0.0.1 -n 50 && vssadmin.exe delete shadows /all /quiet
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 50
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
