Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,"%ALLUSERSPROFILE%\Microsoft\Services\mslog.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\onedrivestandaloneupdatetask
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthsystray.exe
Modifies file system
Creates the following files
- %TEMP%\content\3984-3552-<File name>.exe-21-02-26-377.dump
- %TEMP%\content\3984-3552-<File name>.exe-21-02-26-422.dump
- %TEMP%\content\3984-3584-<File name>.exe-21-02-28-877.dump
- %ALLUSERSPROFILE%\microsoft\services\mslog.exe
- C:\msconfig.xml
Network activity
Connects to
- 'pa###bin.com':443
- '14#.#85.221.30':18849
- '1.#.1.1':80
TCP
Other
- 'pa###bin.com':443
UDP
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'CabinetWClass' WindowName: ''
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "IwAgAE0AQQBJAFMATwBOACAARwBFAE4AIABDAE8ARABFACAACgAkAG4AdQBsAGwAIAA9ACAAJABFAHgAZQBjAHUAdABpAG8AbgBDAG8AbgB0AGUAe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABwAGEAdABoAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABUAGEAcwBrAHMAI...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABwAGEAdABoAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABIAGUAbABwACIALAAKACAAIAAgACAAIgBDADoAX...
- '<SYSTEM32>\cmd.exe' /c wevtutil cl "Application
- '<SYSTEM32>\wevtutil.exe' cl "Application
- '<SYSTEM32>\cmd.exe' /c wevtutil cl "Windows PowerShell
- '<SYSTEM32>\wevtutil.exe' cl "Windows PowerShell
- '<SYSTEM32>\icacls.exe' %WINDIR%\Help /reset /C
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\Tasks /reset /C
- '<SYSTEM32>\cmd.exe' /c wevtutil cl "System
- '<SYSTEM32>\icacls.exe' %WINDIR%\Help /setowner "NT SERVICE\TrustedInstaller" /C
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\Tasks /setowner "NT SERVICE\TrustedInstaller" /C
- '<SYSTEM32>\wevtutil.exe' cl "System
- '<SYSTEM32>\cmd.exe' /c wevtutil cl "Security
- '<SYSTEM32>\icacls.exe' %WINDIR%\Help\Corporate /reset /C
- '<SYSTEM32>\wevtutil.exe' cl "Security
- '<SYSTEM32>\icacls.exe' %WINDIR%\Help\Corporate /setowner "NT SERVICE\TrustedInstaller" /C
- '<SYSTEM32>\schtasks.exe' /Create /TN "OneDriveStandaloneUpdateTask" /XML "C:\msconfig.xml" /F
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\bcdedit.exe' /timeout 0
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\Tasks\OneDriveStandaloneUpdateTask /reset /C
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\Tasks\OneDriveStandaloneUpdateTask /setowner "NT SERVICE\TrustedInstaller" /C
- '<SYSTEM32>\icacls.exe' %WINDIR%\Help\Corporate\policyagent.exe /reset /C
- '<SYSTEM32>\icacls.exe' %WINDIR%\Help\Corporate\policyagent.exe /setowner "NT SERVICE\TrustedInstaller" /C
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "IwAgAEwASQBMAFUATQAgAEQASQBTACAASwBVAFIAIABNAFUATgAgAFQASQAgAE0ASQBOAEEATAAgAAoAJAB1AGEAYwBGAGwAYQBnACAAPQAgADEAC...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "IwAgAE0AQQBJAFMATwBOACAARwBFAE4AIABDAE8ARABFACAACgAkAG4AdQBsAGwAIAA9ACAAJABFAHgAZQBjAHUAdABpAG8AbgBDAG8AbgB0AGUAe...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABwAGEAdABoAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABUAGEAcwBrAHMAI...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABwAGEAdABoAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAiAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABIAGUAbABwACIALAAKACAAIAAgACAAIgBDADoAX...' (with hidden window)
- '<SYSTEM32>\reagentc.exe' /disable' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /timeout 0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoLogo -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "IwAgAEwASQBMAFUATQAgAEQASQBTACAASwBVAFIAIABNAFUATgAgAFQASQAgAE0ASQBOAEEATAAgAAoAJAB1AGEAYwBGAGwAYQBnACAAPQAgADEAC...' (with hidden window)
