Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Deletes the following files
- %WINDIR%\prefetch\1.exe-bf9d2cef.pf
- %WINDIR%\prefetch\dllhost.exe-b2eb1806.pf
- %WINDIR%\prefetch\dllhost.exe-d58da3a6.pf
- %WINDIR%\prefetch\dllhost.exe-ecb71776.pf
- %WINDIR%\prefetch\dotnetfx.exe-fe16be11.pf
- %WINDIR%\prefetch\drvinst.exe-4cb4314a.pf
- %WINDIR%\prefetch\excel.exe-53a22446.pf
- %WINDIR%\prefetch\explorer.exe-a80e4f97.pf
- %WINDIR%\prefetch\dllhost.exe-7faa2e4c.pf
- %WINDIR%\prefetch\dllhost.exe-861f96f8.pf
- %WINDIR%\prefetch\firefox.exe-18acfcff.pf
- %WINDIR%\prefetch\install.exe-455f2d9b.pf
- %WINDIR%\prefetch\ipconfig.exe-912f3d5b.pf
- %WINDIR%\prefetch\javaw.exe-dccf0ab8.pf
- %WINDIR%\prefetch\kmsnano_setup.exe-631a87c6.pf
- %WINDIR%\prefetch\kmsnano_setup.tmp-11a1562c.pf
- %WINDIR%\prefetch\launcher.exe-e41e51ee.pf
- %WINDIR%\prefetch\layout.ini
- %WINDIR%\prefetch\flashplayerupdateservice.exe-216d9c35.pf
- %WINDIR%\prefetch\iexplore.exe-4b6c9213.pf
- %WINDIR%\prefetch\dllhost.exe-766398d2.pf
- %WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
- %WINDIR%\prefetch\dexplore.exe-1749d792.pf
- %WINDIR%\prefetch\addinutil.exe-fef23417.pf
- %WINDIR%\prefetch\agapplaunch.db
- %WINDIR%\prefetch\agcx_sc4.db
- %WINDIR%\prefetch\agglfaulthistory.db
- %WINDIR%\prefetch\agglfgapphistory.db
- %WINDIR%\prefetch\agglglobalhistory.db
- %WINDIR%\prefetch\aggluad_p_s-1-5-21-1960123792-2022915161-3775307078-1001.db
- %WINDIR%\prefetch\aggluad_s-1-5-21-1960123792-2022915161-3775307078-1001.db
- %WINDIR%\prefetch\acrord32.exe-acf2947d.pf
- %WINDIR%\prefetch\agrobust.db
- %WINDIR%\prefetch\aspnet_regiis.exe-b76f1ad7.pf
- %WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
- %WINDIR%\prefetch\bcssync.exe-3f6c64a2.pf
- %WINDIR%\prefetch\cmd.exe-4a81b364.pf
- %WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
- %WINDIR%\prefetch\control.exe-817f8f1d.pf
- %WINDIR%\prefetch\dbgclr.exe-ad18e06e.pf
- %WINDIR%\prefetch\defrag.exe-588f90ad.pf
- %WINDIR%\prefetch\arh.exe-f07e6c2c.pf
- %WINDIR%\prefetch\logonui.exe-09140401.pf
- %WINDIR%\prefetch\manageddbgca.exe-6ea1439b.pf
Deletes itself.
Network activity
UDP
- DNS ASK pt#.#iscord.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\sc.exe' config wdfilter start=disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' config WerSvc start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop wdfilter' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WerSvc' (with hidden window)
- '<SYSTEM32>\sc.exe' config WinDefend start=disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' config WdNisSvc start=disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' config XblGameSave start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop XblGameSave' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\f36c6010-1c11-414e-ad8a-2efe03216a09.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\sc.exe' config wdfilter start=disabled
- '<SYSTEM32>\attrib.exe' -r -s -h "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\f36c6010-1c11-414e-ad8a-2efe03216a09.bat"
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\sc.exe' stop XblGameSave
- '<SYSTEM32>\cmd.exe' /c sc stop XblGameSave
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend
- '<SYSTEM32>\sc.exe' stop wdfilter
- '<SYSTEM32>\sc.exe' config XblGameSave start=disabled
- '<SYSTEM32>\sc.exe' config WdNisSvc start=disabled
- '<SYSTEM32>\sc.exe' config WinDefend start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop WerSvc
- '<SYSTEM32>\cmd.exe' /c sc stop wdfilter
- '<SYSTEM32>\sc.exe' config WerSvc start=disabled
- '<SYSTEM32>\sc.exe' stop WerSvc
- '<SYSTEM32>\timeout.exe' /T 1
