Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
Modifies file system
Creates the following files
- %ProgramFiles%\explorerpatcher\ep_setup.exe
- %ProgramFiles%\explorerpatcher\explorerpatcher.ia-32.dll
- %ProgramFiles%\explorerpatcher\explorerpatcher.amd64.dll
- %ProgramFiles%\explorerpatcher\ep_gui.dll
- %ProgramFiles%\explorerpatcher\ep_dwm_svc.exe
- %ProgramFiles%\explorerpatcher\ep_weather_host.dll
- %ProgramFiles%\explorerpatcher\ep_weather_host_stub.dll
- %ProgramFiles%\explorerpatcher\webview2loader.dll
- %ProgramFiles%\explorerpatcher\ep_taskbar.0.dll
- %WINDIR%\dxgi.dll
- %WINDIR%\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\dxgi.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\explorerpatcher\properties (explorerpatcher).lnk
- %APPDATA%\explorerpatcher\twinui.pcshell.pdb
- %APPDATA%\explorerpatcher\startui.pdb
Modifies the following files
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
Network activity
Connects to
- 'gi##ub.com':443
- 'vs###########ssu5shard4.blob.core.windows.net':443
- 'oc##.#ectigo.com':80
- 're#########ets.githubusercontent.com':443
- 'vs###########ssu5shard50.blob.core.windows.net':443
- 'ap#.msn.com':443
TCP
HTTP GET requests
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5a##############
Other
- 'gi##ub.com':443
- 'vs###########ssu5shard4.blob.core.windows.net':443
- 're#########ets.githubusercontent.com':443
- 'vs###########ssu5shard50.blob.core.windows.net':443
- 'ap#.msn.com':443
UDP
- DNS ASK gi##ub.com
- DNS ASK vs###########ssu5shard4.blob.core.windows.net
- DNS ASK oc##.#ectigo.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK vs###########ssu5shard50.blob.core.windows.net
- DNS ASK ap#.msn.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'TrayClockWClass' WindowName: ''
- ClassName: 'Shell_SecondaryTrayWnd' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "<SYSTEM32>\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "
- '<SYSTEM32>\sc.exe' stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
- '<SYSTEM32>\sc.exe' delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
- '<SYSTEM32>\sc.exe' start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\ExplorerPatcher\ep_weather_host.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\ExplorerPatcher\ep_weather_host_stub.dll"
- '%WINDIR%\explorer.exe'
- '%WINDIR%\explorer.exe' /NoUACCheck
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "<SYSTEM32>\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "' (with hidden window)
- '<SYSTEM32>\sc.exe' stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB' (with hidden window)
- '<SYSTEM32>\sc.exe' start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB' (with hidden window)
