Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\systemonedriveupdatetaskmachinecoretask
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command $exclusions = Get-MpPreference | Select-Object -ExpandProperty ExclusionPath; $progData = '%ALLUSERSPROFILE%'; $sysProfile = [System.Environment]::GetFolderPath('System') + '\config\sy...
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\wbem.{208d2c60-3aea-1069-a2d7-08002b30309d}\wmiprvse.exe
- nul
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\systemonedrivesvc64a.exe
- <SYSTEM32>\config\systemprofile\appdata\roaming\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\winring0x64.sys
Deletes itself.
Network activity
UDP
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\wbem.{208d2c60-3aea-1069-a2d7-08002b30309d}\wmiprvse.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C net session
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' config WaaSMedicSvc start= disabled
- '<SYSTEM32>\cmd.exe' /C rmdir /S /Q "%SystemDrive%\\inetpub"
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\powercfg.exe' /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "SystemOneDriveUpdateTaskMachineCoreTask" /TR "%ALLUSERSPROFILE%\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe" /RU SYSTEM /RL HIGHEST /F
- '<SYSTEM32>\cmd.exe' /c timeout /t 5 /nobreak >nul & del "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 5 /nobreak
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 1 /TN "SystemOneDriveUpdateTaskMachineCoreTask" /TR "%ALLUSERSPROFILE%\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe" /RU SYSTEM /RL HIGHEST /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c timeout /t 5 /nobreak >nul & del "<Full path to file>"' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\wbem.{208d2c60-3aea-1069-a2d7-08002b30309d}\wmiprvse.exe' ' (with hidden window)
