Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ServiceKMS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ServiceKMS] 'ImagePath' = '<SYSTEM32>\svchost.exe -k ServiceKMS'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\ServiceKMS\Parameters] 'ServiceDll' = '<SYSTEM32>\Service_KMS.dll'
Creates the following services
- 'ServiceKMS' <SYSTEM32>\svchost.exe -k ServiceKMS
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /pid 3052 /t
Modifies file system
Creates the following files
- <SYSTEM32>\service_kms.dll
- <SYSTEM32>\log\20210304_1180.log
Deletes itself.
Network activity
UDP
- DNS ASK sa##.onpxe.com
- '255.255.255.255':56717
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /pid 3052 /t & del /s /q "<Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\svchost.exe' -k ServiceKMS
- '<SYSTEM32>\cmd.exe' /c taskkill /pid 3052 /t & del /s /q "<Full path to file>"
