Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Google Update Agent' = '"%LOCALAPPDATA%\Microsoft\DeviceMetadataStore\ShellExperienceHost.exe" worker'
- [HKCU\Environment] 'UserInitMprLogonScript' = '"%LOCALAPPDATA%\Microsoft\DeviceMetadataStore\ShellExperienceHost.exe" worker'
Creates or modifies the following files
- <SYSTEM32>\tasks\nvcontainertask_mfi38z5dmv
Malicious functions
Patches code
in AMSI dll
- hfdwxf.exe process, Amsi.dll module
- shellexperiencehost.exe process, Amsi.dll module
in NTDLL dll
- hfdwxf.exe process, ntdll.dll module
- shellexperiencehost.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\wc_debug.log
- %LOCALAPPDATA%\microsoft\devicemetadatastore\shellexperiencehost.exe
- nul
- %TEMP%\.mn_6933387a35644d56.pid
- %TEMP%\.wd_6933387a35644d56.pid
Deletes itself.
Network activity
Connects to
- '<DNS_SERVER>':53
- 'we###ystal.sbs':443
- 'ap#.#pify.org':443
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/json/185.93.40.66?fi################
Other
- 'we###ystal.sbs':443
- 'ap#.#pify.org':443
UDP
- DNS ASK we###ystal.sbs
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\devicemetadatastore\shellexperiencehost.exe' worker
- '%LOCALAPPDATA%\microsoft\devicemetadatastore\shellexperiencehost.exe' watchdog 3720
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /TN NvContainerTask_MFi38z5dMV /TR "\"%LOCALAPPDATA%\Microsoft\DeviceMetadataStore\ShellExperienceHost.exe\" worker" /SC ONLOGON /RL HIGHEST /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "$ws=(New-Object -ComObject WScript.Shell).CreateShortcut('%!!(string=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Google Update Agent.lnk)s(M...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='Google Update Agent_Filter';$fi.EventNamespac...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -Force '<Full path to file>' -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Select-Object -ExpandProperty Name) -join ','"
- '<SYSTEM32>\cmd.exe' /C wmic "path win32_VideoController get name"
- '<SYSTEM32>\wbem\wmic.exe' "path win32_VideoController get name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').ProductName"
- '<SYSTEM32>\cmd.exe' /C fm:drives
- '<SYSTEM32>\cmd.exe' /C taskmgr:processes
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter \"Name='Google Update Agent_Filter'\" -ErrorAction Si...
- '<SYSTEM32>\schtasks.exe' /Query /TN NvContainerTask_MFi38z5dMV
- '<SYSTEM32>\cmd.exe' /C "@echo off & chcp 65001>nul & cd & echo __webrat_cwd__%CD%"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\schtasks.exe' /Create /TN NvContainerTask_MFi38z5dMV /TR "\"%LOCALAPPDATA%\Microsoft\DeviceMetadataStore\ShellExperienceHost.exe\" worker" /SC ONLOGON /RL HIGHEST /F' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "$ws=(New-Object -ComObject WScript.Shell).CreateShortcut('%!!(string=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Google Update Agent.lnk)s(M...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='Google Update Agent_Filter';$fi.EventNamespac...' (with hidden window)
- '%LOCALAPPDATA%\microsoft\devicemetadatastore\shellexperiencehost.exe' worker' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -Force '<Full path to file>' -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Select-Object -ExpandProperty Name) -join ','"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic "path win32_VideoController get name"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').ProductName"' (with hidden window)
- '%LOCALAPPDATA%\microsoft\devicemetadatastore\shellexperiencehost.exe' watchdog 3720' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C fm:drives' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskmgr:processes' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter \"Name='Google Update Agent_Filter'\" -ErrorAction Si...' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Query /TN NvContainerTask_MFi38z5dMV' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "@echo off & chcp 65001>nul & cd & echo __webrat_cwd__%CD%"' (with hidden window)
