Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Environment] 'UserInitMprLogonScript' = '%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveSync.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdgeUpdateSvc' = '%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveSync.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoftedgeupdate.lnk
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\onedrive\onedrivesync.exe
- %LOCALAPPDATA%\microsoft\onedrive\desktop.ini:syncdata
Network activity
Connects to
- '13#.#2.180.28':80
- 'po#####.#pc.subquery.network':443
- 'x1.#.lencr.org':80
- 'po#######or-rpc.publicnode.com':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'po#####.#pc.subquery.network':443
- 'po#######or-rpc.publicnode.com':443
UDP
- DNS ASK po#####.#pc.subquery.network
- DNS ASK x1.#.lencr.org
- DNS ASK po#######or-rpc.publicnode.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\onedrive\onedrivesync.exe'
Executes the following
- '%LOCALAPPDATA%\microsoft\onedrive\onedrivesync.exe' ' (with hidden window)
