Technical Information
Malicious functions
Injects code into
the following user processes:
- msedge.exe
- launcher.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\60642c8d7d350d73cd3a5cae6cd41634.jpg
- %TEMP%\tmpe436.tmp
- %TEMP%\tmpe437.tmp
- %TEMP%\tmpe457.tmp
- %TEMP%\tmpe458.tmp
- %TEMP%\tmpe488.tmp
- %TEMP%\tmpe715.tmp
- %TEMP%\tmpeb7f.tmp
- %TEMP%\tmpeb80.tmp
- %TEMP%\tmp2732.tmp
- %TEMP%\tmp27ee.tmp
- %TEMP%\tmp27ee.tmp-shm
- %TEMP%\tmp283d.tmp
- %TEMP%\tmp283d.tmp-shm
- %TEMP%\tmp2919.tmp
- %TEMP%\tmp2aa1.tmp
Deletes following files that it created itself
- %TEMP%\tmpe715.tmp
- %TEMP%\tmpe488.tmp
- %TEMP%\tmpe436.tmp
- %TEMP%\tmpe437.tmp
- %TEMP%\tmpe457.tmp
- %TEMP%\tmpe458.tmp
- %TEMP%\tmpeb80.tmp
- %TEMP%\tmpeb7f.tmp
- %TEMP%\tmp2732.tmp
- %TEMP%\tmp27ee.tmp
- %TEMP%\tmp283d.tmp
- %TEMP%\tmp2919.tmp
- %TEMP%\tmp2aa1.tmp
Miscellaneous
Searches for the following windows
- ClassName: 'NarratorUIClass' WindowName: ''
Executes the following
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
- '%ProgramFiles(x86)%\opera\launcher.exe' --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
