Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'steamuiupdater.exe' = '%ProgramFiles(x86)%\Steam\steamuiupdater.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'EpicOnlineServicesUpdater.exe' = '%ProgramFiles(x86)%\Epic Games\Epic Online Services\EpicOnlineServicesUpdater.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'scuiupd.exe' = '%ProgramFiles(x86)%\Rockstar Games\Social Club\scuiupd.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'G HUB tray.exe' = 'C":\\Program Files\\LGHUB\\system_tray\\G HUB tray.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Riot Client Updater.exe' = 'C":\\Riot Games\\Riot Client\\RiotClientElectron\\Riot Client Updater.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'MSIAfterburnerServiceMonitorTray.exe' = '%ProgramFiles(x86)%\MSI Afterburner\MSIAfterburnerServiceMonitorTray.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'NVIDIA app tray.exe' = 'C":\\Program Files\\NVIDIA Corporation\\NVIDIA app\\CEF\\NVIDIA app tray.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'twain_32.exe' = '<SYSTEM32>\twain_32.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'system auditor.exe' = 'C":\\Windows\\security\\audit\\system auditor.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'EpicOnlineServicesInstalator.exe' = '%ALLUSERSPROFILE%\Epic\EpicGamesLauncher\EpicOnlineServicesInstalator.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\winlogon
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\sessionuserhost.exe
- %ProgramFiles(x86)%\steam\steamuiupdater.exe
- <SYSTEM32>\twain_32.exe
- %ALLUSERSPROFILE%\controlhost.exe
- %ALLUSERSPROFILE%\sessionhost.exe
- %ALLUSERSPROFILE%\userhost.exe
Deletes the following files
- <SYSTEM32>\recovery\reagent.xml
Network activity
Connects to
- 'uf##aa.ru':80
- 'pa###bin.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://uf##aa.ru/PacketgeoDbbaseFlowerDatalifeLocalpublicDownloads/da5911c60d39ce73116584ec5e0325f503780e55693c9952e76cab1c0441652055d0bd67ed27bb89
- http://pk#.goog/gsr1/gsr1.crt
- http://uf##aa.ru/PacketgeoDbbaseFlowerDatalifeLocalpublicDownloads/9a094aaf722f08d3740be907a66838ad10afc6b865efdfd57fdb96d631878268f5775ef930869653
- http://uf##aa.ru/PacketgeoDbbaseFlowerDatalifeLocalpublicDownloads/6adc1e14c896571371bc6e1c4f7763c7dd67d22a0fa376726207bab855d42dfae89552cc17559ca3
- http://uf##aa.ru/PacketgeoDbbaseFlowerDatalifeLocalpublicDownloads/6adc1e14c896571371bc6e1c4f7763c7dd67d22af827cc0b57c4bde8e8925ba6f4120c2f803e7acc
Other
- 'pa###bin.com':443
UDP
- DNS ASK uf##aa.ru
- DNS ASK pa###bin.com
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\sessionuserhost.exe'
- '%ALLUSERSPROFILE%\controlhost.exe'
- '%ALLUSERSPROFILE%\sessionhost.exe'
- '%ALLUSERSPROFILE%\userhost.exe'
Executes the following
- '<SYSTEM32>\sc.exe' start "WLJNDOJC"
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\fltmc.exe' unload SysmonDrv
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' create "WLJNDOJC" binpath= "%ALLUSERSPROFILE%\zrntznqzxmws\ydmehmmzlokc.exe" start= "auto"
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\cmd.exe' /k fltMC.exe unload SysmonDrv
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' create InputService binPath=%ALLUSERSPROFILE%\sessionuserhost.exe DisplayName=MicrosoftInputService type=own start=auto
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /create /ru System /tn WinLogOn /tr %ALLUSERSPROFILE%\sessionuserhost.exe /sc onlogon /rl HIGHEST
- '<SYSTEM32>\sc.exe' create "EJJYGAKZ" binpath= "%ALLUSERSPROFILE%\jtixikfvpels\lxwvsyozcpiw.exe" start= "auto"
- '<SYSTEM32>\sc.exe' delete "WLJNDOJC"
- '<SYSTEM32>\cmd.exe' /c sc create InputService binPath=%ALLUSERSPROFILE%\sessionuserhost.exe DisplayName=MicrosoftInputService type=own start=auto
- '<SYSTEM32>\sc.exe' start "EJJYGAKZ"
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%\
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c schtasks /create /ru System /tn WinLogOn /tr %ALLUSERSPROFILE%\sessionuserhost.exe /sc onlogon /rl HIGHEST
- '<SYSTEM32>\sc.exe' delete "EJJYGAKZ"
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\cmd.exe' /c reagentc /disable
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%\' (with hidden window)
- '%ALLUSERSPROFILE%\sessionhost.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\userhost.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\controlhost.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k fltMC.exe unload SysmonDrv' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /ru System /tn WinLogOn /tr %ALLUSERSPROFILE%\sessionuserhost.exe /sc onlogon /rl HIGHEST' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reagentc /disable' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc create InputService binPath=%ALLUSERSPROFILE%\sessionuserhost.exe DisplayName=MicrosoftInputService type=own start=auto' (with hidden window)
- '%ALLUSERSPROFILE%\sessionuserhost.exe' ' (with hidden window)
