Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\runtimebroker.exe
Patches code
in AMSI dll
- runtimebroker.exe process, Amsi.dll module
Modifies file system
Creates the following files
- %TEMP%\7056234726.exe
- C:\users\public\coin_wallet_installer.exe
- %TEMP%\tmp5729.tmp
- %TEMP%\tmp5768.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\coin_wallet_installer.exe.log
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\26c212d9399727259664bdfca073966e_912c3ca51de6018a7be4ca7bc64aafcd
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\c60c0c29522e01e6a22bd2717f20782e_a02bd75495f6a73ffec840201ba1361b
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_430ea0912164d1b129d6e1dc07c63959
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_49536ab5156bdd74eff881d01c36a419
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_eaf5d55d93603a879fa973006301f24f
- %LOCALAPPDATA%\packages\microsoft.windowsstore_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\fb0d848f74f70bb2eaa93746d24d9749
Deletes following files that it created itself
- %TEMP%\tmp5729.tmp
- %TEMP%\tmp5768.tmp
Network activity
Connects to
- 'storeedge.microsoft.com':443
- 'displaycatalog.mp.microsoft.com':443
- 'store-images.s-microsoft.com':443
- 'oneocsp.microsoft.com':80
- 'store-images.microsoft.com':443
- 'storeedgefd.dsx.mp.microsoft.com':443
- 't.#e':443
- 'go#####agmanager.com':443
- 'da.###xservices.com':443
- 'ch##s.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?17##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
Other
- 'storeedge.microsoft.com':443
- 'da.###xservices.com':443
- 'store-images.s-microsoft.com':443
- 'store-images.microsoft.com':443
- 'livetileedge.dsx.mp.microsoft.com':443
- 'microsoft.com':443
- 'apps.microsoft.com':443
- 'go#####agmanager.com':443
- 'ch##s.com':443
UDP
- DNS ASK storeedge.microsoft.com
- DNS ASK displaycatalog.mp.microsoft.com
- DNS ASK store-images.s-microsoft.com
- DNS ASK oneocsp.microsoft.com
- DNS ASK store-images.microsoft.com
- DNS ASK storeedgefd.dsx.mp.microsoft.com
- DNS ASK t.#e
- DNS ASK microsoft.com
- DNS ASK apps.microsoft.com
- DNS ASK go#####agmanager.com
- DNS ASK wcpstatic.microsoft.com
- DNS ASK da.###xservices.com
- DNS ASK livetileedge.dsx.mp.microsoft.com
- DNS ASK ch##s.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7056234726.exe'
- 'C:\users\public\coin_wallet_installer.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\7056234726.exe
- '%ProgramFiles%\windowsapps\microsoft.windowsstore_11910.1002.5.0_x64__8wekyb3d8bbwe\winstore.app.exe' -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c %TEMP%\7056234726.exe' (with hidden window)
