Technical Information
Malicious functions
Injects code into
the following user processes:
- msedge.exe
Modifies file system
Creates the following files
- nul
- %TEMP%\svchost_1770169594914.exe
- %TEMP%\af_scan_1770169599597.py
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6.dat
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat.log1
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat.log1
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat.log1
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat
- %TEMP%\trace_1770169594807\nrihfcb_1770169617013.zip
Deletes following files that it created itself
- %TEMP%\trace_1770169594807\nrihfcb_1770169617013.zip
- %TEMP%\svchost_1770169594914.exe
Network activity
Connects to
- 'ap#.#pify.org':443
- 'di##ord.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?90##############
Other
- 'ap#.#pify.org':443
- 'di##ord.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost_1770169594914.exe' -k -o %TEMP%\elevator_out_1770169596995 all
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV"
- '<SYSTEM32>\tasklist.exe' /FO CSV
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\HARDWARE\ACPI\FADT\VBOX__"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmci"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmtools" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\ControlSet001\Services\vmtools"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\QEMU" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\HARDWARE\ACPI\DSDT\QEMU"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Wine" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Wine"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\Software\Wine" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\Software\Wine"
- '<SYSTEM32>\cmd.exe' /d /s /c "REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" /v DriverDesc 2>nul"
- '<SYSTEM32>\reg.exe' QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" /v DriverDesc
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_videocontroller get description 2>nul"
- '<SYSTEM32>\wbem\wmic.exe' path win32_videocontroller get description
- '<SYSTEM32>\cmd.exe' /d /s /c "curl -s https://api.ipify.org"
- '<SYSTEM32>\curl.exe' -s https://api.ipify.org
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get serialnumber,manufacturer 2>nul"
- '<SYSTEM32>\wbem\wmic.exe' bios get serialnumber,manufacturer
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get manufacturer,model 2>nul"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get manufacturer,model
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid 2>nul"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "python "%TEMP%\af_scan_1770169599597.py""
- '%ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appinstallerpythonredirector.exe' "%TEMP%\af_scan_1770169599597.py"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\HARDWARE\ACPI\FADT\VBOX__" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmtools" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\QEMU" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Wine" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\Software\Wine" 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" /v DriverDesc 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_videocontroller get description 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "curl -s https://api.ipify.org"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get serialnumber,manufacturer 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get manufacturer,model 2>nul"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid 2>nul"' (with hidden window)
- '%TEMP%\svchost_1770169594914.exe' -k -o %TEMP%\elevator_out_1770169596995 all' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "python "%TEMP%\af_scan_1770169599597.py""' (with hidden window)
