Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\intelprocessor
- <SYSTEM32>\tasks\puijilece
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\IntelUpdate.exe'"
Network activity
Connects to
- 'cd#.##scordapp.com':443
TCP
Other
- 'cd#.##scordapp.com':443
UDP
- DNS ASK cd#.##scordapp.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\IntelUpdate.exe'"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "IntelProcessor" /tr "%LOCALAPPDATA%\Microsoft\IntelUpdate.exe" /sc onlogon /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IntelProcessor" /tr "%LOCALAPPDATA%\Microsoft\IntelUpdate.exe" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "Puijilece" /tr "%LOCALAPPDATA%\Microsoft\IntelUpdate.exe" /sc hourly /mo 1 /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Puijilece" /tr "%LOCALAPPDATA%\Microsoft\IntelUpdate.exe" /sc hourly /mo 1 /rl highest /f
