Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurityUpdate' = '<Current directory>\setup.exe'
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsSecurityUpdate" dir=in action=allow program="<Current directory>\setup.exe" enable=yes
Modifies file system
Creates the following files
- %TEMP%\we5ya0bw.44c
- %TEMP%\victim_info.txt
Deletes following files that it created itself
- %TEMP%\we5ya0bw.44c
Network activity
TCP
Other
- 'ap#.#pify.org':443
- 'di##ord.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall delete rule name="WindowsSecurityUpdate"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WindowsSecurityUpdate"
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="WindowsSecurityUpdate" dir=in action=allow program="<Current directory>\setup.exe" enable=yes
