Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Creates and executes the following
- 'C:\users\public\defendercontrol.exe' /D
- 'C:\users\public\defendercontrol.exe' /SYS 1
- 'C:\users\public\defendercontrol.exe' /Q
Downloads
- http://ga###ardsy.com/ahmadtestupl/defendercontrol.exe as c:\users\public\defendercontrol.exe
- http://ga###ardsy.com/ahmadtestupl/defenderkill.txt as c:\users\public\defenderkill.lnk
- http://ga###ardsy.com/ahmadtestupl/defender.bat as c:\users\public\defender.bat
- http://ga###ardsy.com/ahmadtestupl/defendercontrol.txt as c:\users\public\defendercontrol.ini
- http://ga###ardsy.com/ahmadtestupl/ff.ps1 as c:\users\public\ff.ps1
Modifies file system
Creates the following files
- C:\users\public\start.bat
- C:\users\public\chrome.vbs
- C:\users\public\defendercontrol.exe
- C:\users\public\defenderkill.lnk
- C:\users\public\defender.bat
- C:\users\public\defendercontrol.ini
- C:\users\public\ff.ps1
- %TEMP%\autc65a.tmp
- %TEMP%\cficyab
- %WINDIR%\temp\autca31.tmp
- %WINDIR%\temp\ypfwynb
- %TEMP%\autd632.tmp
- %TEMP%\xvcagbt
- C:\users\public\microsoft.ps1
Deletes the following files
- %TEMP%\autc65a.tmp
- %TEMP%\cficyab
- %WINDIR%\temp\autca31.tmp
- %WINDIR%\temp\ypfwynb
- %TEMP%\autd632.tmp
- %TEMP%\xvcagbt
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
- %ALLUSERSPROFILE%\tempntuser.pol
Network activity
Connects to
- 'ar##ive.org':443
- 'ga###ardsy.com':80
TCP
- 'ar##ive.org':443
- 'ia#####5.us.archive.org':443
- 'ia#####0.us.archive.org':443
- 'ia#####4.us.archive.org':443
UDP
- DNS ASK ar##ive.org
- DNS ASK ia#####5.us.archive.org
- DNS ASK ia#####0.us.archive.org
- DNS ASK ga###ardsy.com
- DNS ASK ia#####4.us.archive.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' C:\Users\Public\Chrome.vbs
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Chrome.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\ff.ps1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc QwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABzAHQAYQByAHQALgBiAGEAdAA=' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc QwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABzAHQAYQByAHQALgBiAGEAdAA=
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\start.bat""
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\Defender.bat" "
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\raserver.exe' /offerraupdate
