Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\winsvc] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\winsvc] 'ImagePath' = '<SYSTEM32>\winsvc.exe'
Creates the following services
- 'winsvc' <SYSTEM32>\winsvc.exe
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' "/F" "/IM" "winnet.exe"
- '<SYSTEM32>\taskkill.exe' "/F" "/IM" "wincfg.exe"
Modifies file system
Creates the following files
- <SYSTEM32>\.co777d.tmp
- %TEMP%\temp-1aaad114623fcb89\o
- %TEMP%\temp-c8e70da49247d89f\o
- %TEMP%\temp-991b884fd33469c1\o
- %TEMP%\temp-9ba085860dbf302b\o
- %WINDIR%\temp\__psscriptpolicytest_opadghqk.eky.ps1
- %WINDIR%\temp\__psscriptpolicytest_2xsphv1i.c0c.psm1
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-00-814.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-01-158.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-01-305.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-01-661.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-01-878.dump
- %WINDIR%\temp\__psscriptpolicytest_3wj1oxy1.rhw.ps1
- %WINDIR%\temp\__psscriptpolicytest_l5yo4eef.yjl.psm1
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-03-210.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-03-396.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-03-534.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-03-804.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-05-133.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-06-949.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-07-637.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-07-753.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-07-791.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-07-860.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-07-938.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-08-061.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-08-139.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-12-912.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-129.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-214.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-261.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-301.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-370.dump
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-434.dump
- %WINDIR%\temp\temp-76604f0c57369106\e
- %WINDIR%\temp\content\3292-4020-powershell.exe-22-09-13-527.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_kfi3klna.odw.ps1
- %WINDIR%\temp\__psscriptpolicytest_eu3btasm.jjq.psm1
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-16-877.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-17-222.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-17-361.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-17-562.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-17-646.dump
- %WINDIR%\temp\__psscriptpolicytest_tt0awwp3.viu.ps1
- %WINDIR%\temp\__psscriptpolicytest_5l4l2lwo.uq2.psm1
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-17-941.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-17-995.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-079.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-281.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-469.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-602.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-777.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-874.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-943.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-18-999.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-064.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-119.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-162.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-822.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-922.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-969.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-19-985.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-20-007.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-20-069.dump
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-20-123.dump
- %WINDIR%\temp\temp-fb8381ce1514e5dd\e
- %WINDIR%\temp\content\4792-2152-powershell.exe-22-09-20-185.dump
- %WINDIR%\temp\__psscriptpolicytest_mvsdhiit.qjo.ps1
- %WINDIR%\temp\__psscriptpolicytest_lea2pgjr.kty.psm1
- %WINDIR%\temp\content\3244-3084-powershell.exe-22-09-22-980.dump
- %WINDIR%\temp\content\3244-3084-powershell.exe-22-09-24-321.dump
- %WINDIR%\temp\__psscriptpolicytest_uqks1bvy.eq5.ps1
- %WINDIR%\temp\__psscriptpolicytest_iti2p0ty.qol.psm1
- %WINDIR%\temp\content\2608-3428-powershell.exe-22-09-26-760.dump
Deletes following files that it created itself
- %TEMP%\temp-1aaad114623fcb89\o
- %TEMP%\temp-c8e70da49247d89f\o
- %TEMP%\temp-991b884fd33469c1\o
- %TEMP%\temp-9ba085860dbf302b\o
- %WINDIR%\temp\__psscriptpolicytest_opadghqk.eky.ps1
- %WINDIR%\temp\__psscriptpolicytest_2xsphv1i.c0c.psm1
- %WINDIR%\temp\__psscriptpolicytest_3wj1oxy1.rhw.ps1
- %WINDIR%\temp\__psscriptpolicytest_l5yo4eef.yjl.psm1
- %WINDIR%\temp\temp-76604f0c57369106\e
- %WINDIR%\temp\__psscriptpolicytest_kfi3klna.odw.ps1
- %WINDIR%\temp\__psscriptpolicytest_eu3btasm.jjq.psm1
- %WINDIR%\temp\__psscriptpolicytest_tt0awwp3.viu.ps1
- %WINDIR%\temp\__psscriptpolicytest_5l4l2lwo.uq2.psm1
- %WINDIR%\temp\temp-fb8381ce1514e5dd\e
- %WINDIR%\temp\__psscriptpolicytest_mvsdhiit.qjo.ps1
- %WINDIR%\temp\__psscriptpolicytest_lea2pgjr.kty.psm1
- %WINDIR%\temp\__psscriptpolicytest_uqks1bvy.eq5.ps1
- %WINDIR%\temp\__psscriptpolicytest_iti2p0ty.qol.psm1
Moves the following files
- from <SYSTEM32>\.co777d.tmp to <SYSTEM32>\winsvc.exe
Deletes itself.
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\winsvc.exe' "<Full path to file>"
- '<SYSTEM32>\winsvc.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"<SYSTEM32>\winsvc.exe\"" "DisplayName=\"Windows System Service...
- '<SYSTEM32>\sc.exe' create winsvc type=own start=auto error=ignore binPath=<SYSTEM32>\winsvc.exe "DisplayName=Windows System Service"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
- '<SYSTEM32>\sc.exe' failure winsvc reset=0 actions=restart/0/restart/0/restart/0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
- '<SYSTEM32>\sc.exe' description winsvc "Windows System Service is the main system supervision service."
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "\"<SYSTEM32>\sc.exe\"" "start" "winsvc"
- '<SYSTEM32>\sc.exe' start winsvc
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"<SYSTEM32>\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"%WINDIR%\Temp\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
- '<SYSTEM32>\powercfg.exe' -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
- '<SYSTEM32>\powercfg.exe' -change standby-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
- '<SYSTEM32>\powercfg.exe' -change standby-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
- '<SYSTEM32>\powercfg.exe' -change hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
- '<SYSTEM32>\powercfg.exe' -change hibernate-timeout-dc 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
