Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '<SYSTEM32>\7868.exe'
Modifies file system
Creates the following files
- %TEMP%\_mei61002\vcruntime140.dll
- %TEMP%\_mei61002\_asyncio.pyd
- %TEMP%\_mei61002\_bz2.pyd
- %TEMP%\_mei61002\_cffi_backend.cp310-win_amd64.pyd
- %TEMP%\_mei61002\_ctypes.pyd
- %TEMP%\_mei61002\_decimal.pyd
- %TEMP%\_mei61002\_hashlib.pyd
- %TEMP%\_mei61002\_lzma.pyd
- %TEMP%\_mei61002\_multiprocessing.pyd
- %TEMP%\_mei61002\_overlapped.pyd
- %TEMP%\_mei61002\_queue.pyd
- %TEMP%\_mei61002\_socket.pyd
- %TEMP%\_mei61002\_ssl.pyd
- %TEMP%\_mei61002\base_library.zip
- %TEMP%\_mei61002\certifi\cacert.pem
- %TEMP%\_mei61002\charset_normalizer\md.cp310-win_amd64.pyd
- %TEMP%\_mei61002\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei61002\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei61002\libcrypto-1_1.dll
- %TEMP%\_mei61002\libffi-7.dll
- %TEMP%\_mei61002\libssl-1_1.dll
- %TEMP%\_mei61002\pyexpat.pyd
- %TEMP%\_mei61002\python3.dll
- %TEMP%\_mei61002\python310.dll
- %TEMP%\_mei61002\select.pyd
- %TEMP%\_mei61002\unicodedata.pyd
- %TEMP%\v_54qmef
- %TEMP%\tmpymk442d2.tmp
- %TEMP%\tmpfu_4g_1w.txt
- %TEMP%\update_7033.py
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6.dat
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat.log1
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\user.dat
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat.log1
- %LOCALAPPDATA%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\systemappdata\helium\userclasses.dat
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat.log1
- %ALLUSERSPROFILE%\packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\s-1-5-21-4226853953-3309226944-3078887307-1000\systemappdata\helium\cache\fbe763a1dba895b6_com15.dat
- %TEMP%\tmp5si1vlrg.exe
- %TEMP%\hidden_4936.tmp
- %TEMP%\system_scan_report.json
Sets the 'hidden' attribute to the following files
- %TEMP%\hidden_4936.tmp
Deletes following files that it created itself
- %TEMP%\v_54qmef
- %TEMP%\tmpymk442d2.tmp
- %TEMP%\tmpfu_4g_1w.txt
- %TEMP%\update_7033.py
- %TEMP%\tmp5si1vlrg.exe
- %TEMP%\hidden_4936.tmp
- %TEMP%\system_scan_report.json
- %TEMP%\_mei61002\base_library.zip
- %TEMP%\_mei61002\certifi\cacert.pem
- %TEMP%\_mei61002\charset_normalizer\md.cp310-win_amd64.pyd
- %TEMP%\_mei61002\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
- %TEMP%\_mei61002\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei61002\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei61002\libcrypto-1_1.dll
- %TEMP%\_mei61002\libffi-7.dll
- %TEMP%\_mei61002\libssl-1_1.dll
- %TEMP%\_mei61002\pyexpat.pyd
- %TEMP%\_mei61002\python3.dll
- %TEMP%\_mei61002\python310.dll
- %TEMP%\_mei61002\select.pyd
- %TEMP%\_mei61002\unicodedata.pyd
- %TEMP%\_mei61002\vcruntime140.dll
- %TEMP%\_mei61002\_asyncio.pyd
- %TEMP%\_mei61002\_bz2.pyd
- %TEMP%\_mei61002\_cffi_backend.cp310-win_amd64.pyd
- %TEMP%\_mei61002\_ctypes.pyd
- %TEMP%\_mei61002\_decimal.pyd
- %TEMP%\_mei61002\_hashlib.pyd
- %TEMP%\_mei61002\_lzma.pyd
- %TEMP%\_mei61002\_multiprocessing.pyd
- %TEMP%\_mei61002\_overlapped.pyd
- %TEMP%\_mei61002\_queue.pyd
- %TEMP%\_mei61002\_socket.pyd
- %TEMP%\_mei61002\_ssl.pyd
Network activity
Connects to
- '<DNS_SERVER>':53
- 'ex##ple.com':80
- 'localhost':4444
TCP
HTTP GET requests
- http://ex##ple.com/
UDP
- DNS ASK ex##ple.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c "sc query"
- '<SYSTEM32>\sc.exe' query
- '<SYSTEM32>\cmd.exe' /c "python "%TEMP%\update_7033.py""
- '%ProgramFiles%\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\appinstallerpythonredirector.exe' "%TEMP%\update_7033.py"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%TEMP%\hidden_4936.tmp"
- '<SYSTEM32>\attrib.exe' +h +s "%TEMP%\hidden_4936.tmp"
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc query"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "python "%TEMP%\update_7033.py""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
