Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveUpdate' = '%APPDATA%\WindowsDefender\WindowsDefender.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe, %APPDATA%\WindowsDefender\WindowsDefender.exe'
Modifies file system
Creates the following files
- <Current directory>\data-dir-191882375\control-port-386079313.tmp
- <Current directory>\data-dir-191882375\state.tmp
- <Current directory>\data-dir-191882375\control_auth_cookie.tmp
- <Current directory>\data-dir-191882375\unverified-microdesc-consensus.tmp
- <Current directory>\data-dir-191882375\cached-certs.tmp
- <Current directory>\data-dir-191882375\cached-microdesc-consensus.tmp
- <Current directory>\data-dir-191882375\cached-microdescs.new
Deletes the following files
- <Current directory>\data-dir-191882375\control-port-386079313
- <Current directory>\data-dir-191882375\unverified-microdesc-consensus
Moves the following files
- from <Current directory>\data-dir-191882375\control-port-386079313.tmp to <Current directory>\data-dir-191882375\control-port-386079313
- from <Current directory>\data-dir-191882375\state.tmp to <Current directory>\data-dir-191882375\state
- from <Current directory>\data-dir-191882375\control_auth_cookie.tmp to <Current directory>\data-dir-191882375\control_auth_cookie
- from <Current directory>\data-dir-191882375\unverified-microdesc-consensus.tmp to <Current directory>\data-dir-191882375\unverified-microdesc-consensus
- from <Current directory>\data-dir-191882375\cached-certs.tmp to <Current directory>\data-dir-191882375\cached-certs
- from <Current directory>\data-dir-191882375\cached-microdesc-consensus.tmp to <Current directory>\data-dir-191882375\cached-microdesc-consensus
Substitutes the following files
- <Current directory>\data-dir-191882375\control-port-386079313.tmp
- <Current directory>\data-dir-191882375\control-port-386079313
Network activity
Connects to
- 'localhost':49174
- '97.##.237.196':9001
- '19#.#34.15.57':443
- '85.##.159.65':80
- '18#.#20.101.4':30004
- '18#.#20.101.7':30007
- '19#.#60.102.170':9001
- '18#.#20.101.130':10130
- '18#.#38.112.60':1521
- '12#.31.0.13':443
- '79.##3.36.68':443
- '19#.#60.102.165':9001
- '16#.#72.149.155':443
- '49.##.115.210':443
- '37.##9.8.104':9001
- '81.#.209.10':80
- '18#.#20.101.14':30014
- '21#.#2.199.190':443
- '37.##7.255.35':9090
- '20#.#1.50.131':9001
- '93.##5.97.242':9001
- '16#.#72.139.104':443
- '19#.#8.81.140':443
- '92.##2.38.67':443
- '18#.#6.88.29':443
- '19#.#71.202.146':9001
- '17#.#8.193.43':443
- 'localhost':49176
- '14#.#6.14.145':143
- '17#.#3.183.251':443
TCP
Other
- 'localhost':49176
- '18#.#20.101.4':30004
- '85.##.159.65':80
- '18#.#20.101.130':10130
- '18#.#20.101.7':30007
- '19#.#60.102.170':9001
- '19#.#60.102.165':9001
- '20#.#1.50.131':9001
- '12#.31.0.13':443
- '19#.#34.15.57':443
- '18#.#38.112.60':1521
- '49.##.115.210':443
- '79.##3.36.68':443
- '18#.#20.101.14':30014
- '16#.#72.139.104':443
- '37.##9.8.104':9001
- '37.##7.255.35':9090
- '19#.#8.81.140':443
- 'localhost':49177
- '16#.#72.149.155':443
- '17#.#3.183.251':443
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __EventFilter CREATE Name='GuacBypassFilter', EventNameSpace='root\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent W...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH CommandLineEventConsumer CREATE Name='WindowsDefender', ExecutablePath='%APPDATA%\WindowsDefender\WindowsDefender.exe',CommandLineTemplate='%APPDA...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name='GuacBypassFilter'', Consumer='CommandLineEventConsumer.Name='GuacBypassConsomer''"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __EventFilter CREATE Name='GuacBypassFilter', EventNameSpace='root\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent W...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:'\\root\subscription' PATH __EventFilter CREATE Name='GuacBypassFilter', EventNameSpace='root\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 ...
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH CommandLineEventConsumer CREATE Name='WindowsDefender', ExecutablePath='%APPDATA%\WindowsDefender\WindowsDefender.exe',CommandLineTemplate='%APPDA...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:'\\root\subscription' PATH CommandLineEventConsumer CREATE Name='WindowsDefender', ExecutablePath='%APPDATA%\WindowsDefender\WindowsDefender.exe',CommandLineTemplate='%APPDATA%\Windo...
- '<SYSTEM32>\cmd.exe' /C "wmic /namespace:'\\root\subscription' PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name='GuacBypassFilter'', Consumer='CommandLineEventConsumer.Name='GuacBypassConsomer''"
- '<SYSTEM32>\wbem\wmic.exe' /namespace:'\\root\subscription' PATH __FilterToConsumerBinding CREATE Filter='__EventFilter.Name='GuacBypassFilter'', Consumer='CommandLineEventConsumer.Name='GuacBypassConsomer''
