Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
blocks the following features:
- User Account Control (UAC)
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\wbem\wmiprvse.exe
Modifies file system
Creates the following files
- <Current directory>\wmgbhowgkjdh.exe
- %TEMP%\c9b905bf-9657-4c61-b7c6-94e3c384f998.bat
- %TEMP%\84a75361-bfb9-42b9-a9e7-fb973e2d5a89.bat
Sets the 'hidden' attribute to the following files
- %TEMP%\c9b905bf-9657-4c61-b7c6-94e3c384f998.bat
- %TEMP%\84a75361-bfb9-42b9-a9e7-fb973e2d5a89.bat
Network activity
UDP
- DNS ASK au##.#eprimere.shop
- DNS ASK au##.#nknownp.one
Miscellaneous
Creates and executes the following
- '<Current directory>\wmgbhowgkjdh.exe' 1
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\c9b905bf-9657-4c61-b7c6-94e3c384f998.bat""
- '<SYSTEM32>\timeout.exe' /T 1
- '<SYSTEM32>\attrib.exe' -r -s -h "<Full path to file>"
- '<SYSTEM32>\attrib.exe' -r -s -h "%TEMP%\c9b905bf-9657-4c61-b7c6-94e3c384f998.bat"
- '<SYSTEM32>\cmd.exe' /c sc stop wdfilter
- '<SYSTEM32>\cmd.exe' /c sc stop WerSvc
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc
- '<SYSTEM32>\cmd.exe' /c sc stop wuauserv
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\84a75361-bfb9-42b9-a9e7-fb973e2d5a89.bat""
- '<SYSTEM32>\sc.exe' stop wdfilter
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' stop WerSvc
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\attrib.exe' -r -s -h "%TEMP%\84a75361-bfb9-42b9-a9e7-fb973e2d5a89.bat"
- '<SYSTEM32>\cmd.exe' /c sc stop wdfilter' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WerSvc' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop wuauserv' (with hidden window)
