Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\device management host v3.42
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%APPDATA%\Device Management Host v5.42' -Force -ErrorAction SilentlyContinue; Add-MpPreference ...
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Device Management Host v3.42" dir=in action=allow program="%APPDATA%\Device Management Host v5.42\DeviceManagementHost.exe" enable=yes
Modifies file system
Creates the following files
- %LOCALAPPDATA%\1fcbfbff000606a6f449bb9c
- %APPDATA%\device management host v5.42\devicemanagementhost.exe
- %TEMP%\tmp9825.tmp.bat
- %TEMP%\tmp9864.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- nul
- %TEMP%\content\756-1196-devicemanagementhost.exe-17-06-09-392.dump
- %TEMP%\content\756-1196-devicemanagementhost.exe-17-06-09-420.dump
- %APPDATA%\microsoft\configuracoes\uid.txt
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\devicemanagementhost.exe.log
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\1fcbfbff000606a6f449bb9c
- %APPDATA%\device management host v5.42\devicemanagementhost.exe
Network activity
Connects to
- 'ap#.#pify.org':80
- 'up#######tem.ddnsgratis.com.br':443
TCP
HTTP GET requests
- http://ap#.#pify.org/
Other
- 'up#######tem.ddnsgratis.com.br':443
UDP
- DNS ASK up#######tem.ddnsgratis.com.br
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\device management host v5.42\devicemanagementhost.exe'
Executes the following
- '<SYSTEM32>\sc.exe' query "Device Management Host v3.42Svc"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' $filter = Get-WmiObject -Namespace 'root\subscription' -Class __EventFilter -Filt...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp9825.tmp.bat""
- '<SYSTEM32>\schtasks.exe' /Create /TN "Device Management Host v3.42Advanced" /XML "%TEMP%\tmp9864.tmp" /F
- '<SYSTEM32>\timeout.exe' 4
- '<SYSTEM32>\schtasks.exe' /create /f /sc MINUTE /mo 1 /tn "Device Management Host v3.42" /tr "\"%APPDATA%\Device Management Host v5.42\DeviceManagementHost.exe\""
