Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Bw6d8Paf6bOV36xS4N6' = '%WINDIR%\Resources\Themes\aero\Shell\eCD9cjXnQ68Ged31T2X6ac6dL39YG124d98OXa10c044\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qweruiuyt' = '%TEMP%\qweruiuyt\qweruiuyt.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bw6d8paf6bov36xs4n6.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\igefx_mod.exe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Bw6d8Paf6bOV36xS4N6.exe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Resources\Themes\aero\Shell\eCD9cjXnQ68Ged31T2X6ac6dL39YG124d98OXa10c044\svchost.exe' = '00000000'
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\igefx_mod.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\igefx_mod.exe" -Force
Injects code into
the following user processes:
- igefx_mod.exe
Modifies file system
Creates the following files
- %APPDATA%\igefx_mod.exe
- %WINDIR%\resources\themes\aero\shell\ecd9cjxnq68ged31t2x6ac6dl39yg124d98oxa10c044\svchost.exe
- %TEMP%\qweruiuyt\qweruiuyt.exe
Network activity
Connects to
- 'mi######.#3-us-west-2.amazonaws.com':80
UDP
- DNS ASK mi######.#3-us-west-2.amazonaws.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\bw6d8paf6bov36xs4n6.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\eCD9cjXnQ68Ged31T2X6ac6dL39YG124d98OXa10c044\svchost.exe" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\igefx_mod.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Bw6d8Paf6bOV36xS4N6.exe" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\eCD9cjXnQ68Ged31T2X6ac6dL39YG124d98OXa10c044\svchost.exe" -Force' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Bw6d8Paf6bOV36xS4N6.exe" -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\eCD9cjXnQ68Ged31T2X6ac6dL39YG124d98OXa10c044\svchost.exe" -Force
