Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveUpdate' = '%APPDATA%\WindowsDefender\WindowsDefender.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe, %APPDATA%\WindowsDefender\WindowsDefender.exe'
Modifies file system
Creates the following files
- <Current directory>\data-dir-765619239\control-port-431418609.tmp
- <Current directory>\data-dir-765619239\state.tmp
- <Current directory>\data-dir-765619239\control_auth_cookie.tmp
- <Current directory>\data-dir-765619239\unverified-microdesc-consensus.tmp
- <Current directory>\data-dir-765619239\cached-certs.tmp
- <Current directory>\data-dir-765619239\cached-microdesc-consensus.tmp
- <Current directory>\data-dir-765619239\cached-microdescs.new
Deletes the following files
- <Current directory>\data-dir-765619239\control-port-431418609
- <Current directory>\data-dir-765619239\unverified-microdesc-consensus
Moves the following files
- from <Current directory>\data-dir-765619239\control-port-431418609.tmp to <Current directory>\data-dir-765619239\control-port-431418609
- from <Current directory>\data-dir-765619239\state.tmp to <Current directory>\data-dir-765619239\state
- from <Current directory>\data-dir-765619239\control_auth_cookie.tmp to <Current directory>\data-dir-765619239\control_auth_cookie
- from <Current directory>\data-dir-765619239\unverified-microdesc-consensus.tmp to <Current directory>\data-dir-765619239\unverified-microdesc-consensus
- from <Current directory>\data-dir-765619239\cached-certs.tmp to <Current directory>\data-dir-765619239\cached-certs
- from <Current directory>\data-dir-765619239\cached-microdesc-consensus.tmp to <Current directory>\data-dir-765619239\cached-microdesc-consensus
Substitutes the following files
- <Current directory>\data-dir-765619239\control-port-431418609.tmp
- <Current directory>\data-dir-765619239\control-port-431418609
Network activity
Connects to
- 'localhost':49173
- '79.##3.36.68':443
- '37.#53.1.10':9001
- '21#.#41.138.174':9001
- '54.##.138.138':993
- '16#.#72.149.155':443
- '19#.#34.15.60':443
- '85.##.201.47':9001
- '91.##9.20.27':9001
- '16#.#72.157.213':443
- '37.##9.8.104':9001
- '96.##3.78.108':443
- '5.##.111.149':443
- '19#.#60.102.166':9001
- '14#.#72.118.118':443
- '18#.#00.86.182':8080
- '18#.#20.101.130':10130
- '51.#5.78.0':9001
- '13#.#43.214.137':443
- 'localhost':49175
- '19#.#0.191.95':443
- '19#.#84.246.250':443
- '17#.#54.19.101':443
- '21#.#1.134.123':9001
- '19#.#7.28.82':9001
- '18#.#20.101.12':10012
- '18#.#00.85.101':9001
- '97.##.237.196':9001
- '51.##4.147.57':443
- '81.#.14.253':443
- '18#.#6.180.29':443
- '5.###.88.122':9001
- '21#.#39.217.18':1337
- '92.##2.38.67':443
- '17#.#0.104.240':443
TCP
- 'localhost':49175
- '19#.#60.102.166':9001
- '5.##.111.149':443
- '96.##3.78.108':443
- '16#.#72.157.213':443
- '37.##9.8.104':9001
- '19#.#34.15.60':443
- '18#.#20.101.130':10130
- '21#.#41.138.174':9001
- '37.#53.1.10':9001
- '14#.#72.118.118':443
- '79.##3.36.68':443
- '18#.#00.86.182':8080
- '18#.#00.85.101':9001
- '81.#.14.253':443
- '18#.#20.101.12':10012
- '51.#5.78.0':9001
- '19#.#7.28.82':9001
- '19#.#84.246.250':443
- '19#.#0.191.95':443
- 'localhost':49176
- '97.##.237.196':9001
- '17#.#0.104.240':443
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __EventFilter CREATE Name='GuacBypassFilter', EventNameSpace='root\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent W...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH CommandLineEventConsumer CREATE Name='WindowsDefender', ExecutablePath='%APPDATA%\WindowsDefender\WindowsDefender.exe',CommandLineTemplate='%APPDA...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name='GuacBypassFilter'', Consumer='CommandLineEventConsumer.Name='GuacBypassConsomer''"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __EventFilter CREATE Name='GuacBypassFilter', EventNameSpace='root\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent W...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:'\\root\subscription' PATH __EventFilter CREATE Name='GuacBypassFilter', EventNameSpace='root\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 ...
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH CommandLineEventConsumer CREATE Name='WindowsDefender', ExecutablePath='%APPDATA%\WindowsDefender\WindowsDefender.exe',CommandLineTemplate='%APPDA...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:'\\root\subscription' PATH CommandLineEventConsumer CREATE Name='WindowsDefender', ExecutablePath='%APPDATA%\WindowsDefender\WindowsDefender.exe',CommandLineTemplate='%APPDATA%\Windo...
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name='GuacBypassFilter'', Consumer='CommandLineEventConsumer.Name='GuacBypassConsomer''"
- '<SYSTEM32>\wbem\wmic.exe' /namespace:'\\root\subscription' PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name='GuacBypassFilter'', Consumer='CommandLineEventConsumer.Name='GuacBypassConsomer''
