Technical Information
Triggers a user-defined sigma rule:
- 24357373-078f-44ed-9ac4-6d334a668a11
- de587dce-915e-4218-aac4-835ca6af6f70
- 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
- 92626ddd-662c-49e3-ac59-f6535f12d189
- 81325ce1-be01-4250-944f-b4789644556f
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinSvc' = '<SYSTEM32>\winsvc.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\winsvc
Modifies file system
Creates the following files
- %TEMP%\dxdiag_1700.exe
- nul
- <SYSTEM32>\winsvc.exe
- %TEMP%\winsvc.xml
Deletes following files that it created itself
- %TEMP%\winsvc.xml
Network activity
Connects to
- 'ap#.##launch.net':443
TCP
Other
- 'ap#.##launch.net':443
UDP
- DNS ASK ap#.##launch.net
Miscellaneous
Creates and executes the following
- '%TEMP%\dxdiag_1700.exe'
Executes the following
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion /v _rs_test /f
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WinSvc /t REG_SZ /d <SYSTEM32>\winsvc.exe /f
- '<SYSTEM32>\schtasks.exe' /query /tn WinSvc /fo csv /v
- '<SYSTEM32>\schtasks.exe' /create /tn WinSvc /xml %TEMP%\winsvc.xml /f
