Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CoreWorker_FHvCgFmXTzJrwFX' = '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_FHvCgFmXTzJrwFX.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windows repair.lnk
- <SYSTEM32>\tasks\coreworker_fhvcgfmxtzjrwfx-3465
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"
Patches code
in AMSI dll
- pwunjfs.exe process, Amsi.dll module
in NTDLL dll
- pwunjfs.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %LOCALAPPDATA%\mpdefendercorefolder\coreworker_fhvcgfmxtzjrwfx.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- nul
- %APPDATA%\true_fhvcgfmxtzjrwfx
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\mpdefendercorefolder\coreworker_fhvcgfmxtzjrwfx.exe
Network activity
Connects to
- '17#.#68.136.38':8000
- 'ip##pi.com':80
- '45.##4.169.172':8000
TCP
HTTP GET requests
- http://ip##pi.com/json/
Other
- '17#.#68.136.38':8000
- '45.##4.169.172':8000
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\mpdefendercorefolder\coreworker_fhvcgfmxtzjrwfx.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_FHvCgFmXTzJrwFX.exe...
Executes the following
- '<SYSTEM32>\cmd.exe' powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
- '<SYSTEM32>\cmd.exe' /C timeout /t 4 /nobreak >nul & Del "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 4 /nobreak
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"
- '<SYSTEM32>\cmd.exe' powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C timeout /t 4 /nobreak >nul & Del "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute '%LOCALAPPDATA%\MpDefenderCoreFolder\CoreWorker_FHvCgFmXTzJrwFX.exe...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\MpDefenderCoreFolder'"' (with hidden window)
