Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftedgeupdatetaskmachinebin
Modifies file system
Creates the following files
- %TEMP%\_mei18882\vcruntime140.dll
- %TEMP%\_mei30162\libcrypto-1_1.dll
- %TEMP%\_mei30162\charset_normalizer\md__mypyc.cp37-win_amd64.pyd
- %TEMP%\_mei30162\charset_normalizer\md.cp37-win_amd64.pyd
- %TEMP%\_mei30162\_ssl.pyd
- %TEMP%\_mei30162\_socket.pyd
- %TEMP%\_mei30162\_queue.pyd
- %TEMP%\_mei30162\_overlapped.pyd
- %TEMP%\_mei30162\_multiprocessing.pyd
- %TEMP%\_mei30162\_lzma.pyd
- %TEMP%\_mei30162\_hashlib.pyd
- %TEMP%\_mei30162\_elementtree.pyd
- %TEMP%\_mei30162\_decimal.pyd
- %TEMP%\_mei30162\_ctypes.pyd
- %TEMP%\_mei30162\_bz2.pyd
- %TEMP%\_mei30162\_asyncio.pyd
- %TEMP%\_mei30162\vcruntime140.dll
- %TEMP%\_mei30162\vcruntime140_1.dll
- %TEMP%\_mei30162\libssl-1_1.dll
- %TEMP%\_mei30162\psutil\_psutil_windows.pyd
- %TEMP%\_mei30162\importlib_metadata-6.0.0.dist-info\wheel
- %TEMP%\_mei30162\importlib_metadata-6.0.0.dist-info\record
- %TEMP%\_mei30162\importlib_metadata-6.0.0.dist-info\metadata
- %TEMP%\_mei30162\importlib_metadata-6.0.0.dist-info\license
- %TEMP%\_mei30162\importlib_metadata-6.0.0.dist-info\installer
- %TEMP%\_mei30162\certifi\cacert.pem
- %TEMP%\_mei30162\base_library.zip
- %TEMP%\_mei30162\win32wnet.pyd
- %TEMP%\_mei18882\winsound.pyd
- %TEMP%\_mei30162\win32api.pyd
- %TEMP%\_mei30162\unicodedata.pyd
- %TEMP%\_mei30162\select.pyd
- %TEMP%\_mei30162\pywin32_system32\pywintypes37.dll
- %TEMP%\_mei30162\python37.dll
- %TEMP%\_mei30162\python3.dll
- %TEMP%\_mei30162\pyexpat.pyd
- %TEMP%\uselesscash33912.xml
- %ALLUSERSPROFILE%\msedge\con\msegde.exe
- %TEMP%\gzlj8bl7
- %TEMP%\_mei18882\charset_normalizer\md.cp37-win_amd64.pyd
- %TEMP%\_mei18882\_ssl.pyd
- %TEMP%\_mei18882\_socket.pyd
- %TEMP%\_mei18882\_queue.pyd
- %TEMP%\_mei18882\_overlapped.pyd
- %TEMP%\_mei18882\_multiprocessing.pyd
- %TEMP%\_mei18882\_lzma.pyd
- %TEMP%\_mei18882\_hashlib.pyd
- %TEMP%\_mei18882\_elementtree.pyd
- %TEMP%\_mei18882\_decimal.pyd
- %TEMP%\_mei18882\_ctypes.pyd
- %TEMP%\_mei18882\_bz2.pyd
- %TEMP%\_mei18882\_asyncio.pyd
- %TEMP%\_mei18882\vcruntime140_1.dll
- %TEMP%\_mei18882\libcrypto-1_1.dll
- %TEMP%\_mei18882\libssl-1_1.dll
- %TEMP%\_mei18882\charset_normalizer\md__mypyc.cp37-win_amd64.pyd
- %TEMP%\_mei18882\psutil\_psutil_windows.pyd
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\top_level.txt
- %TEMP%\_mei18882\pyexpat.pyd
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\wheel
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\record
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\metadata
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\license
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\installer
- %TEMP%\_mei18882\certifi\cacert.pem
- %TEMP%\_mei30162\winsound.pyd
- %TEMP%\_mei30162\importlib_metadata-6.0.0.dist-info\top_level.txt
- %TEMP%\_mei18882\win32wnet.pyd
- %TEMP%\_mei18882\win32api.pyd
- %TEMP%\_mei18882\unicodedata.pyd
- %TEMP%\_mei18882\select.pyd
- %TEMP%\_mei18882\pywin32_system32\pywintypes37.dll
- %TEMP%\_mei18882\python37.dll
- %TEMP%\_mei18882\python3.dll
- %TEMP%\_mei18882\base_library.zip
- %TEMP%\iznxd2ut
Deletes the following files
- %TEMP%\gzlj8bl7
- %TEMP%\_mei18882\vcruntime140.dll
- %TEMP%\_mei18882\vcruntime140_1.dll
- %TEMP%\_mei18882\win32api.pyd
- %TEMP%\_mei18882\win32wnet.pyd
- %TEMP%\_mei18882\winsound.pyd
- %TEMP%\_mei18882\_asyncio.pyd
- %TEMP%\_mei18882\_bz2.pyd
- %TEMP%\_mei18882\_decimal.pyd
- %TEMP%\_mei18882\_ssl.pyd
- %TEMP%\_mei18882\_elementtree.pyd
- %TEMP%\_mei18882\_hashlib.pyd
- %TEMP%\_mei18882\_lzma.pyd
- %TEMP%\_mei18882\_multiprocessing.pyd
- %TEMP%\_mei18882\_overlapped.pyd
- %TEMP%\_mei18882\_queue.pyd
- %TEMP%\_mei18882\_socket.pyd
- %TEMP%\_mei18882\unicodedata.pyd
- %TEMP%\_mei18882\_ctypes.pyd
- %TEMP%\_mei18882\select.pyd
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\metadata
- %TEMP%\uselesscash33912.xml
- %TEMP%\_mei18882\base_library.zip
- %TEMP%\_mei18882\certifi\cacert.pem
- %TEMP%\_mei18882\charset_normalizer\md.cp37-win_amd64.pyd
- %TEMP%\_mei18882\charset_normalizer\md__mypyc.cp37-win_amd64.pyd
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\installer
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\license
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\record
- %TEMP%\_mei18882\python37.dll
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\top_level.txt
- %TEMP%\_mei18882\importlib_metadata-6.0.0.dist-info\wheel
- %TEMP%\_mei18882\libcrypto-1_1.dll
- %TEMP%\_mei18882\libssl-1_1.dll
- %TEMP%\_mei18882\psutil\_psutil_windows.pyd
- %TEMP%\_mei18882\pyexpat.pyd
- %TEMP%\_mei18882\python3.dll
- %TEMP%\_mei18882\pywin32_system32\pywintypes37.dll
- %TEMP%\iznxd2ut
Network activity
Connects to
- 'if##nfig.me':80
- 'ip##fo.io':80
- 'tl#.io':443
- 'tl#.io':80
TCP
HTTP GET requests
- http://if##nfig.me/
- http://ip##fo.io/json
- http://tl#.io/ProtankCon700
- http://tl#.io/700135204436102441com
- http://tl#.io/700135204436102441resp
- http://tl#.io/700135204436102441mskb
Other
- 'tl#.io':443
UDP
- DNS ASK if##nfig.me
- DNS ASK ip##fo.io
- DNS ASK tl#.io
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\msedge\con\msegde.exe'
- '<SYSTEM32>\cmd.exe' /c "SCHTASKS /Create /SC MINUTE /MO 1 /TN MicrosoftEdgeUpdateTaskMachineBin /TR C:\\ProgramData\Msedge\con\\msegde.exe -F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /Query /XML ONE /TN "MicrosoftEdgeUpdateTaskMachineBin""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "SCHTASKS /Create /TN MicrosoftEdgeUpdateTaskMachineBin /XML %TEMP%\UselessCash33912.xml -F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "SCHTASKS /RUN /TN MicrosoftEdgeUpdateTaskMachineBin"' (with hidden window)
- '%ALLUSERSPROFILE%\msedge\con\msegde.exe' ' (with hidden window)
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "SCHTASKS /Create /SC MINUTE /MO 1 /TN MicrosoftEdgeUpdateTaskMachineBin /TR C:\\ProgramData\Msedge\con\\msegde.exe -F"
- '<SYSTEM32>\cmd.exe' /c "schtasks /Query /XML ONE /TN "MicrosoftEdgeUpdateTaskMachineBin""
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN MicrosoftEdgeUpdateTaskMachineBin /TR C:\\ProgramData\Msedge\con\\msegde.exe -F
- '<SYSTEM32>\schtasks.exe' /Query /XML ONE /TN "MicrosoftEdgeUpdateTaskMachineBin"
- '<SYSTEM32>\cmd.exe' /c "SCHTASKS /Create /TN MicrosoftEdgeUpdateTaskMachineBin /XML %TEMP%\UselessCash33912.xml -F"
- '<SYSTEM32>\schtasks.exe' /Create /TN MicrosoftEdgeUpdateTaskMachineBin /XML %TEMP%\UselessCash33912.xml -F
- '<SYSTEM32>\cmd.exe' /c "SCHTASKS /RUN /TN MicrosoftEdgeUpdateTaskMachineBin"
- '<SYSTEM32>\schtasks.exe' /RUN /TN MicrosoftEdgeUpdateTaskMachineBin
- '<SYSTEM32>\taskeng.exe' {02D57043-E27C-4F83-BD15-2EFCE2AAEA88} S-1-5-21-3150914307-1777937420-491476919-1000:kkcwnuww\user:Interactive:[1]
