Technical Information
Triggers a user-defined sigma rule:
- 2aa0a6b4-a865-495b-ab51-c28249537b75
- 66d31e5f-52d6-40a4-9615-002d3789a119
- d223b46b-5621-4037-88fe-fda32eead684
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\autostarter.lnk
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'
Modifies file system
Creates the following files
- %APPDATA%\autostarter.exe
- %TEMP%\aut631.tmp
- %TEMP%\film.avi
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a76ac26-b90.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a76ac34-d04.pma
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\26c212d9399727259664bdfca073966e_912c3ca51de6018a7be4ca7bc64aafcd
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\892580777767344dcaef580ffa143ea6_ef1b61dd3f93c58dbd0734f13c15c0f6
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\b76be66d46c355931939d8cf818d03fd_39df7432e6ef50cda9c936e29e7da30d
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\b76be66d46c355931939d8cf818d03fd_879afeb08dcb012707582d902977ff92
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_eaf5d55d93603a879fa973006301f24f
- %LOCALAPPDATA%\packages\microsoft.zunevideo_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\fb0d848f74f70bb2eaa93746d24d9749
Deletes following files that it created itself
- %TEMP%\aut631.tmp
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Network activity
Connects to
- 'se######-ssl.xboxlive.com':443
- 'go.microsoft.com':443
- 'oneocsp.microsoft.com':80
- 'activation.playready.microsoft.com':443
- 'co####.edge.skype.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?06##############
- http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAALE%2BVmfUqbVYAAAAAAAAs%3D
Other
- 'se######-ssl.xboxlive.com':443
- 'go.microsoft.com':443
- 'activation.playready.microsoft.com':443
- 'co####.edge.skype.com':443
UDP
- DNS ASK se######-ssl.xboxlive.com
- DNS ASK oneocsp.microsoft.com
- DNS ASK activation.playready.microsoft.com
- DNS ASK st#####dupdate.com.ua
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'NarratorUIClass' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%ProgramFiles%\windowsapps\microsoft.zunevideo_10.19071.19011.0_x64__8wekyb3d8bbwe\video.ui.exe' -ServerName:Microsoft.ZuneVideo.AppX758ya5sqdjd98rx6z7g95nw6jy7bqx9y.mca
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '%ProgramFiles(x86)%\internet explorer\ielowutil.exe' -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\bho\ie_to_edge_stub.exe' --from-ie-to-edge=3 --ie-frame-hwnd=202a2
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=202a2
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=202a2 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=202a2 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
