Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Environment] 'UserInitMprLogonScript' = '%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveSync.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdgeUpdateSvc' = '%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveSync.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoftedgeupdate.lnk
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\onedrive\onedrivesync.exe
- %LOCALAPPDATA%\microsoft\onedrive\desktop.ini:syncdata
- %LOCALAPPDATA%\microsoft\edge\edgeupdate\msedgesynchost.exe
Network activity
Connects to
- '13#.#2.180.28':80
UDP
- DNS ASK po####n.drpc.org
- DNS ASK po####n.lava.build
- DNS ASK po#####.#pc.subquery.network
- DNS ASK 1r#c.io
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\onedrive\onedrivesync.exe'
Executes the following
- '%LOCALAPPDATA%\microsoft\onedrive\onedrivesync.exe' ' (with hidden window)
