Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowspowershell.wbemscripting.swbemlocator
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Cndom6] 'ImagePath' = 'C:\Cndom6.sys'
Creates the following services
- 'Cndom6' C:\Cndom6.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\Users\\Public\\Documents'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\Cndom6.sys'"
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\is-q0c0c.tmp\<File name>.tmp
- %TEMP%\is-3hvin.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3hvin.tmp\_isetup\_shfoldr.dll
- %ALLUSERSPROFILE%\windowsdata\is-1dh22.tmp
- %ALLUSERSPROFILE%\windowsdata\is-lq98v.tmp
- %ALLUSERSPROFILE%\windowsdata\is-mbeen.tmp
- %ALLUSERSPROFILE%\windowsdata\funzip.exe
- %ALLUSERSPROFILE%\windowsdata\men.exe
- C:\users\public\documents\windowsdata\tree.exe
- C:\users\public\documents\windowsdata\me.key
- C:\users\public\documents\windowsdata\kail.exe
- C:\users\public\documents\windowsdata\bypass.exe
- C:\users\public\documents\windowsdata\kang.exe
- C:\users\public\documents\windowsdata\nvidia.lnk
- C:\users\public\documents\windowsdata\nthandlecallback.exe
- C:\cndom6.sys
- %ALLUSERSPROFILE%\windowsdata\del.bat
- nul
- %ALLUSERSPROFILE%\displaysessioncontainers.log
Deletes following files that it created itself
- %ALLUSERSPROFILE%\windowsdata\gynxyplttm.xml
- %TEMP%\is-3hvin.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3hvin.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-q0c0c.tmp\<File name>.tmp
- C:\cndom6.sys
- %ALLUSERSPROFILE%\windowsdata\men.exe
Moves the following files
- from %ALLUSERSPROFILE%\windowsdata\is-1dh22.tmp to %ALLUSERSPROFILE%\windowsdata\gynxyplttm.xml
- from %ALLUSERSPROFILE%\windowsdata\is-lq98v.tmp to %ALLUSERSPROFILE%\windowsdata\server.xml
- from %ALLUSERSPROFILE%\windowsdata\is-mbeen.tmp to %ALLUSERSPROFILE%\windowsdata\server.log
- from %ALLUSERSPROFILE%\windowsdata\server.log to C:\users\public\documents\windowsdata\server.log
Network activity
Connects to
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'uu###ome.com':9000
TCP
Other
- 'uu###ome.com':9000
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK uu###ome.com
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\is-q0c0c.tmp\<File name>.tmp' /SL5="$902BC,5566542,156160,<Full path to file>"
- '%ALLUSERSPROFILE%\windowsdata\funzip.exe' x -y -phtLcENyRFYwXsHFnUnqK -o"%ALLUSERSPROFILE%\WindowsData" "%ALLUSERSPROFILE%\WindowsData\server.xml"
- '%ALLUSERSPROFILE%\windowsdata\men.exe'
- 'C:\users\public\documents\windowsdata\nthandlecallback.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-MpPreference).ExclusionPath|Out-String -Width 4096"
- '<SYSTEM32>\cmd.exe' /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.SWbemLocator" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\...
- '<SYSTEM32>\cmd.exe' /c (del /f /q /s "C:\Users\Public\Documents\WindowsData\*" && del /f /q /s "%ALLUSERSPROFILE%\WindowsData\*" && rmdir /q /s "C:\Users\Public\Documents\WindowsData" && rmdir /q /s "%ALLUSERSPROF...
- '<SYSTEM32>\cmd.exe' /c del.bat
- '<SYSTEM32>\takeown.exe' /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.SWbemLocator" /a
- '<SYSTEM32>\icacls.exe' "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.SWbemLocator" /grant Administrators:F
- '<SYSTEM32>\takeown.exe' /f "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.SWbemLocator" /grant Administrators:F
- '<SYSTEM32>\icacls.exe' "C:\\Windows\\System32\\Tasks\WindowsPowerShell.WbemScripting.SWbemLocator" /deny Everyone:D
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command \"$regPath = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.SWbemLocator'; $acl = (Get-Item -Path $regPath).GetAccess...
- '%ALLUSERSPROFILE%\windowsdata\funzip.exe' x -y -phtLcENyRFYwXsHFnUnqK -o"%ALLUSERSPROFILE%\WindowsData" "%ALLUSERSPROFILE%\WindowsData\server.xml"' (with hidden window)
- '%ALLUSERSPROFILE%\windowsdata\men.exe' ' (with hidden window)
- 'C:\users\public\documents\windowsdata\nthandlecallback.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;(Get-MpPreference).ExclusionPath|Out-String -Width 4096"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "takeown /f "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\WindowsPowerShell.WbemScripting.SWbemLocator" /a >nul 2>&1 & icacls "HKLM\\SOFTWARE\\Microsoft\\...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c (del /f /q /s "C:\Users\Public\Documents\WindowsData\*" && del /f /q /s "%ALLUSERSPROFILE%\WindowsData\*" && rmdir /q /s "C:\Users\Public\Documents\WindowsData" && rmdir /q /s "%ALLUSERSPROF...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del.bat' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\Users\\Public\\Documents'"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\Cndom6.sys'"' (with hidden window)
