Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Control\Session Manager] 'BootExecute' = ''
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im iexplore.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im msedge.exe /f
Modifies file system
Creates the following files
- %TEMP%\nsuodo.dll
- <Current directory>\gp.inf
- %WINDIR%\security\logs\scesrv.log
- <Current directory>\gp.jfm
- <Current directory>\gp.sdb
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab487e2-b50.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab487f1-990.pma
Sets the 'hidden' attribute to the following files
- %TEMP%\nsuodo.dll
- <Current directory>\gp.inf
Deletes the following system files
- %WINDIR%\panther\unattend.xml
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\6z5ae6bt\v1[1].xml
- <Current directory>\gp.inf
Moves the following system files
- from %WINDIR%\security\database\edb.log to %WINDIR%\security\database\edb00001.log
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Network activity
Connects to
- 'co####.edge.skype.com':443
TCP
Other
- 'co####.edge.skype.com':443
UDP
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe'
- '<SYSTEM32>\cmd.exe' /c bcdedit /set testsigning off
- '<SYSTEM32>\bcdedit.exe' /set testsigning off
- '<SYSTEM32>\cmd.exe' /c bcdedit /set nointegritychecks on
- '<SYSTEM32>\bcdedit.exe' /set nointegritychecks on
- '<SYSTEM32>\cmd.exe' /c bcdedit /set hypervisorlaunchtype off
- '<SYSTEM32>\bcdedit.exe' /set hypervisorlaunchtype off
- '%WINDIR%\syswow64\cmd.exe' /c secedit /configure /db gp.sdb /cfg gp.inf
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\bho\ie_to_edge_stub.exe' --from-ie-to-edge=3 --ie-frame-hwnd=80046
- '%WINDIR%\syswow64\secedit.exe' /configure /db gp.sdb /cfg gp.inf
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=80046
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=80046 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '%WINDIR%\syswow64\cmd.exe' /c net accounts /maxpwage:UNLIMITED
- '%WINDIR%\syswow64\net.exe' accounts /maxpwage:UNLIMITED
- '%WINDIR%\syswow64\net1.exe' accounts /maxpwage:UNLIMITED
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q gp.*
- '%WINDIR%\syswow64\cmd.exe' /c powercfg /list
- '%WINDIR%\syswow64\powercfg.exe' /list
- '%WINDIR%\syswow64\cmd.exe' /c powercfg /DUPLICATESCHEME e9a42b02-d5df-448d-aa00-03f14749eb61
- '%WINDIR%\syswow64\powercfg.exe' /DUPLICATESCHEME e9a42b02-d5df-448d-aa00-03f14749eb61
- '<SYSTEM32>\cmd.exe' /c powercfg -h off
- '<SYSTEM32>\powercfg.exe' -h off
- '<SYSTEM32>\cmd.exe' /c powercfg /change /standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /change /standby-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /change /standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /monitor-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /change /monitor-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /monitor-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /change /monitor-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /disk-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /change /disk-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /disk-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /change /disk-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /change /hibernate-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /change /hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /change /hibernate-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
- '<SYSTEM32>\powercfg.exe' /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
- '<SYSTEM32>\cmd.exe' /c powercfg /SETDCVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
- '<SYSTEM32>\powercfg.exe' /SETDCVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit /set useplatformclock no
- '<SYSTEM32>\bcdedit.exe' /set useplatformclock no
- '<SYSTEM32>\cmd.exe' /c bcdedit /set useplatformtick no
- '<SYSTEM32>\bcdedit.exe' /set useplatformtick no
- '<SYSTEM32>\cmd.exe' /c bcdedit /set disabledynamictick yes
- '<SYSTEM32>\bcdedit.exe' /set disabledynamictick yes
- '<SYSTEM32>\cmd.exe' /c netsh interface teredo set state disable
- '<SYSTEM32>\netsh.exe' interface teredo set state disable
- '<SYSTEM32>\cmd.exe' /c netsh interface 6to4 set state disabled
- '<SYSTEM32>\netsh.exe' interface 6to4 set state disabled
- '<SYSTEM32>\cmd.exe' /c netsh interface isatap set state disabled
- '<SYSTEM32>\netsh.exe' interface isatap set state disabled
- '<SYSTEM32>\cmd.exe' /c netsh int tcp set global ecn=disable
- '<SYSTEM32>\netsh.exe' int tcp set global ecn=disable
- '<SYSTEM32>\cmd.exe' /cnetcfg.exe -u ms_pacer
- '<SYSTEM32>\netcfg.exe' -u ms_pacer
- '%WINDIR%\syswow64\rundll32.exe' iesetup.dll,IEHardenUser
- '%WINDIR%\syswow64\rundll32.exe' iesetup.dll,IEHardenAdmin
- '%WINDIR%\syswow64\rundll32.exe' iesetup.dll,IEHardenMachineNow
- '%WINDIR%\syswow64\cmd.exe' /c echo >> <DRIVERS>\etc\hosts
- '%WINDIR%\syswow64\cmd.exe' /c echo 127.0.0.1 ieonline.microsoft.com >> <DRIVERS>\etc\hosts
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q C:\PerfLogs\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q C:\recycled\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Temp\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Tasks\Real*.job
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Prefetch\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Prefetch\ReadyBoot\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q <SYSTEM32>\WDI\LogFiles\*.*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Logs\dosvc\*.*
- '%ProgramFiles%\internet explorer\iexplore.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set testsigning off' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set nointegritychecks on' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set hypervisorlaunchtype off' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c secedit /configure /db gp.sdb /cfg gp.inf' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=80046 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net accounts /maxpwage:UNLIMITED' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q gp.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c powercfg /list' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c powercfg /DUPLICATESCHEME e9a42b02-d5df-448d-aa00-03f14749eb61' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg -h off' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /standby-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /monitor-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /monitor-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /disk-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /disk-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /hibernate-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /change /hibernate-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /SETDCVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set useplatformclock no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set useplatformtick no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set disabledynamictick yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh interface teredo set state disable' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh interface 6to4 set state disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh interface isatap set state disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh int tcp set global ecn=disable' (with hidden window)
- '<SYSTEM32>\cmd.exe' /cnetcfg.exe -u ms_pacer' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /im iexplore.exe /f' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /im msedge.exe /f' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' iesetup.dll,IEHardenUser' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' iesetup.dll,IEHardenAdmin' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' iesetup.dll,IEHardenMachineNow' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q C:\PerfLogs\*.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q C:\recycled\*.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Temp\*.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Tasks\Real*.job' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Prefetch\*.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Prefetch\ReadyBoot\*.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q <SYSTEM32>\WDI\LogFiles\*.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /s /q %WINDIR%\Logs\dosvc\*.*' (with hidden window)
