Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Fatality' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<Full path to file>,C:\Users\Public\Documents\AyreliaSoftwareWF\fatality.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,<Full path to file>,C:\Users\Public\Documents\AyreliaSoftwareWF\fatality.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\fatality.lnk
- <SYSTEM32>\tasks\ayreliasoftwarewf autostart
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\AyreliaSoftwareWFM] 'ImagePath' = '<Full path to file>'
- [HKLM\SYSTEM\CurrentControlSet\Services\AyreliaSoftwareWFC] 'ImagePath' = 'C:\Users\Public\Documents\AyreliaSoftwareWF\fatality.exe'
Creates the following services
- 'AyreliaSoftwareWFM' <Full path to file>
- 'AyreliaSoftwareWFC' C:\Users\Public\Documents\AyreliaSoftwareWF\fatality.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Set-MpPreference -DisableIntrusionPrev...
Modifies file system
Creates the following files
- nul
- C:\users\public\documents\ayreliasoftwarewf\fatality.exe
- \device\harddiskvolume1\boot\bcd.log
- \device\harddiskvolume1\boot\bcd
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Set-MpPreference -Disabl...
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "*" /DISABLE >nul 2>&1
- '<SYSTEM32>\schtasks.exe' /Change /TN "*" /DISABLE
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "AyreliaSoftwareWF AutoStart" /ENABLE >nul 2>&1
- '<SYSTEM32>\schtasks.exe' /Change /TN "AyreliaSoftwareWF AutoStart" /ENABLE
- '<SYSTEM32>\cmd.exe' /c cmd /c echo [InternetShortcut] > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Fatality.lnk" && echo URL=file://<Full path to file> >> "%APPDATA%\Microsoft\Windows\Start Menu\Prog...
- '<SYSTEM32>\cmd.exe' /c echo [InternetShortcut]
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /TN "AyreliaSoftwareWF AutoStart" /TR "<Full path to file>" /RL HIGHEST /F
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN "AyreliaSoftwareWF AutoStart" /TR "<Full path to file>" /RL HIGHEST /F
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "AyreliaSoftwareWF AutoStart" /ENABLE
