Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftedgemonitor
- <SYSTEM32>\tasks\taskserviceupdate
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = 'C:\ckbwsYqzHd\start\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' C:\ckbwsYqzHd\start\WinRing0x64.sys
Modifies file system
Creates the following files
- %TEMP%\_mei44722\cryptodome\cipher\_arc4.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_salsa20.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_chacha20.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_aes.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_aesni.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_arc2.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_blowfish.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_cast.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_cbc.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_cfb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ctr.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_des.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_des3.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ecb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ocb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ofb.pyd
- %TEMP%\_mei44722\cryptodome\hash\_blake2b.pyd
- %TEMP%\_mei44722\cryptodome\hash\_blake2s.pyd
- %TEMP%\_mei44722\cryptodome\hash\_md2.pyd
- %TEMP%\_mei44722\cryptodome\hash\_md4.pyd
- %TEMP%\_mei44722\cryptodome\hash\_md5.pyd
- %TEMP%\_mei44722\cryptodome\hash\_ripemd160.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha1.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha224.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha256.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha384.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha512.pyd
- %TEMP%\_mei44722\cryptodome\hash\_ghash_clmul.pyd
- %TEMP%\_mei44722\cryptodome\hash\_ghash_portable.pyd
- %TEMP%\_mei44722\cryptodome\hash\_keccak.pyd
- %TEMP%\_mei44722\cryptodome\hash\_poly1305.pyd
- %TEMP%\_mei44722\cryptodome\math\_modexp.pyd
- %TEMP%\_mei44722\cryptodome\protocol\_scrypt.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_curve25519.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_curve448.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_ec_ws.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_ed25519.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_ed448.pyd
- %TEMP%\_mei44722\cryptodome\util\_cpuid_c.pyd
- %TEMP%\_mei44722\cryptodome\util\_strxor.pyd
- %TEMP%\_mei44722\vcruntime140.dll
- %TEMP%\_mei44722\vcruntime140_1.dll
- %TEMP%\_mei44722\_asyncio.pyd
- %TEMP%\_mei44722\_bz2.pyd
- %TEMP%\_mei44722\_ctypes.pyd
- %TEMP%\_mei44722\_decimal.pyd
- %TEMP%\_mei44722\_hashlib.pyd
- %TEMP%\_mei44722\_lzma.pyd
- %TEMP%\_mei44722\_multiprocessing.pyd
- %TEMP%\_mei44722\_overlapped.pyd
- %TEMP%\_mei44722\_queue.pyd
- %TEMP%\_mei44722\_socket.pyd
- %TEMP%\_mei44722\_ssl.pyd
- %TEMP%\_mei44722\_wmi.pyd
- %TEMP%\_mei44722\base_library.zip
- %TEMP%\_mei44722\certifi\cacert.pem
- %TEMP%\_mei44722\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei44722\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei44722\libcrypto-3.dll
- %TEMP%\_mei44722\libffi-8.dll
- %TEMP%\_mei44722\libssl-3.dll
- %TEMP%\_mei44722\pyexpat.pyd
- %TEMP%\_mei44722\python313.dll
- %TEMP%\_mei44722\select.pyd
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei44722\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei44722\unicodedata.pyd
- %TEMP%\d1dndr5s
- C:\ckbwsyqzhd\start.zip
- C:\ckbwsyqzhd\start\benchmark_10m.cmd
- C:\ckbwsyqzhd\start\benchmark_1m.cmd
- C:\ckbwsyqzhd\start\config.json
- C:\ckbwsyqzhd\start\microsoft edge.exe
- C:\ckbwsyqzhd\start\pool_mine_example.cmd
- C:\ckbwsyqzhd\start\process guard runtime observer.exe
- C:\ckbwsyqzhd\start\process.bat
- C:\ckbwsyqzhd\start\process1.bat
- C:\ckbwsyqzhd\start\procgov.exe
- C:\ckbwsyqzhd\start\procgov.pdb
- C:\ckbwsyqzhd\start\pucka.bat
- C:\ckbwsyqzhd\start\rtm_ghostrider_example.cmd
- C:\ckbwsyqzhd\start\sha256sums
- C:\ckbwsyqzhd\start\solo_mine_example.cmd
- C:\ckbwsyqzhd\start\start.cmd
- C:\ckbwsyqzhd\start\system guard runtime monitor.exe
- C:\ckbwsyqzhd\start\winring0x64.sys
- %TEMP%\patchupdate411.flag
- %TEMP%\_mei34162\vcruntime140.dll
- %TEMP%\_mei34162\_bz2.pyd
- %TEMP%\_mei34162\_ctypes.pyd
- %TEMP%\_mei34162\_decimal.pyd
- %TEMP%\_mei34162\_hashlib.pyd
- %TEMP%\_mei34162\_lzma.pyd
- %TEMP%\_mei34162\_socket.pyd
- %TEMP%\_mei34162\_ssl.pyd
- %TEMP%\_mei34162\_zstd.pyd
- %TEMP%\_mei34162\base_library.zip
- %TEMP%\_mei34162\libcrypto-3.dll
- %TEMP%\_mei34162\libffi-8.dll
- %TEMP%\_mei34162\libssl-3.dll
- %TEMP%\_mei34162\psutil\_psutil_windows.pyd
- %TEMP%\_mei34162\python3.dll
- %TEMP%\_mei34162\python314.dll
- %TEMP%\_mei34162\select.pyd
- %TEMP%\_mei34162\unicodedata.pyd
- C:\ckbwsyqzhd\start\launcher.vbs
- nul
- C:\ckbwsyqzhd\appy.exe
- %TEMP%\content\3408-6072-appy.exe-15-42-34-469.dump
- %APPDATA%\subdir\service runtime management agent.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\appy.exe.log
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-38-894.dump
- %TEMP%\content\4116-6012-service runtime management agent.exe-15-42-41-432.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-42-429.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-42-655.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-42-817.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-42-838.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-43-261.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-43-428.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-43-438.dump
- %TEMP%\content\4116-5848-service runtime management agent.exe-15-42-43-470.dump
Sets the 'hidden' attribute to the following files
- %APPDATA%\subdir\service runtime management agent.exe
Deletes following files that it created itself
- %TEMP%\d1dndr5s
- %TEMP%\_mei44722\base_library.zip
- %TEMP%\_mei44722\certifi\cacert.pem
- %TEMP%\_mei44722\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei44722\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_arc4.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_chacha20.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_aes.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_aesni.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_arc2.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_blowfish.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_cast.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_cbc.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_cfb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ctr.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_des.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_des3.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ecb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ocb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_raw_ofb.pyd
- %TEMP%\_mei44722\cryptodome\cipher\_salsa20.pyd
- %TEMP%\_mei44722\cryptodome\hash\_blake2b.pyd
- %TEMP%\_mei44722\cryptodome\hash\_blake2s.pyd
- %TEMP%\_mei44722\cryptodome\hash\_ghash_clmul.pyd
- %TEMP%\_mei44722\cryptodome\hash\_ghash_portable.pyd
- %TEMP%\_mei44722\cryptodome\hash\_keccak.pyd
- %TEMP%\_mei44722\cryptodome\hash\_md2.pyd
- %TEMP%\_mei44722\cryptodome\hash\_md4.pyd
- %TEMP%\_mei44722\cryptodome\hash\_md5.pyd
- %TEMP%\_mei44722\cryptodome\hash\_poly1305.pyd
- %TEMP%\_mei44722\cryptodome\hash\_ripemd160.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha1.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha224.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha256.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha384.pyd
- %TEMP%\_mei44722\cryptodome\hash\_sha512.pyd
- %TEMP%\_mei44722\cryptodome\math\_modexp.pyd
- %TEMP%\_mei44722\cryptodome\protocol\_scrypt.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_curve25519.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_curve448.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_ec_ws.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_ed25519.pyd
- %TEMP%\_mei44722\cryptodome\publickey\_ed448.pyd
- %TEMP%\_mei44722\cryptodome\util\_cpuid_c.pyd
- %TEMP%\_mei44722\cryptodome\util\_strxor.pyd
- %TEMP%\_mei44722\libcrypto-3.dll
- %TEMP%\_mei44722\libffi-8.dll
- %TEMP%\_mei44722\libssl-3.dll
- %TEMP%\_mei44722\pyexpat.pyd
- %TEMP%\_mei44722\python313.dll
- %TEMP%\_mei44722\select.pyd
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei44722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei44722\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei44722\unicodedata.pyd
- %TEMP%\_mei44722\vcruntime140.dll
- %TEMP%\_mei44722\vcruntime140_1.dll
- %TEMP%\_mei44722\_asyncio.pyd
- %TEMP%\_mei44722\_bz2.pyd
- %TEMP%\_mei44722\_ctypes.pyd
- %TEMP%\_mei44722\_decimal.pyd
- %TEMP%\_mei44722\_hashlib.pyd
- %TEMP%\_mei44722\_lzma.pyd
- %TEMP%\_mei44722\_multiprocessing.pyd
- %TEMP%\_mei44722\_overlapped.pyd
- %TEMP%\_mei44722\_queue.pyd
- %TEMP%\_mei44722\_socket.pyd
- %TEMP%\_mei44722\_ssl.pyd
- %TEMP%\_mei44722\_wmi.pyd
Network activity
Connects to
- 'dr##box.com':443
- 'uc#############a92a01e232878.dl.dropboxusercontent.com':443
- 'gi##ub.com':443
- 'po##.#ashvault.pro':443
- 'ra#.####ubusercontent.com':443
- 'pa###bin.com':443
- '19#.#9.30.238':4782
TCP
Other
- '15#.#01.1.91':443
- 'dr##box.com':443
- 'uc#############a92a01e232878.dl.dropboxusercontent.com':443
- 'po##.#ashvault.pro':443
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'pa###bin.com':443
UDP
- DNS ASK dr##box.com
- DNS ASK uc#############a92a01e232878.dl.dropboxusercontent.com
- DNS ASK gi##ub.com
- DNS ASK po##.#ashvault.pro
- DNS ASK ra#.####ubusercontent.com
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- 'C:\ckbwsyqzhd\start\process guard runtime observer.exe'
- 'C:\ckbwsyqzhd\start\procgov.exe' --cpu=1 -- "C:\ckbwsYqzHd\start\Microsoft Edge.exe"
- 'C:\ckbwsyqzhd\start\procgov.exe' --monitor --verbose --nogui
- 'C:\ckbwsyqzhd\start\microsoft edge.exe'
- 'C:\ckbwsyqzhd\appy.exe'
- '%APPDATA%\subdir\service runtime management agent.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "C:\ckbwsYqzHd\start\Process Guard Runtime Observer.exe"
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "MicrosoftEdgeMonitor" /tr "C:\ckbwsYqzHd\start\launcher.vbs" /sc onlogon /delay 0002:00 /rl highest /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "MicrosoftEdgeMonitor" /tr "C:\ckbwsYqzHd\start\launcher.vbs" /sc onlogon /delay 0002:00 /rl highest /f
- '<SYSTEM32>\cmd.exe' /c C:\ckbwsYqzHd\start\process.bat
- '<SYSTEM32>\cmd.exe' /c "C:\ckbwsYqzHd\appy.exe"
- '<SYSTEM32>\schtasks.exe' /create /tn "TaskServiceUpdate" /sc ONLOGON /tr "%APPDATA%\SubDir\Service Runtime Management Agent.exe" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c "C:\ckbwsYqzHd\start\Process Guard Runtime Observer.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn "MicrosoftEdgeMonitor" /tr "C:\ckbwsYqzHd\start\launcher.vbs" /sc onlogon /delay 0002:00 /rl highest /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "C:\ckbwsYqzHd\appy.exe"' (with hidden window)
