Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft defender threat intelligence handler
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe
- '<SYSTEM32>\taskkill.exe' /F /IM kometa.exe
- '<SYSTEM32>\taskkill.exe' /F /IM orbitum.exe
- '<SYSTEM32>\taskkill.exe' /F /IM centbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM 7star.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sputnik.exe
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe
- '<SYSTEM32>\taskkill.exe' /F /IM epicprivacybrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe
- '<SYSTEM32>\taskkill.exe' /F /IM uran.exe
- '<SYSTEM32>\taskkill.exe' /F /IM yandex.exe
- '<SYSTEM32>\taskkill.exe' /F /IM iridium.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- nul
- %APPDATA%\displaydriverupdater.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\displaydriverupdater.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft Defender Threat Intelligence Handler" /sc ONLOGON /tr %APPDATA%\DisplayDriverUpdater.exe /rl HIGHEST
- '<SYSTEM32>\tasklist.exe' ' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM kometa.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM orbitum.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM centbrowser.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM 7star.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM sputnik.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM epicprivacybrowser.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM uran.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM yandex.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM iridium.exe' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft Defender Threat Intelligence Handler" /sc ONLOGON /tr %APPDATA%\DisplayDriverUpdater.exe /rl HIGHEST' (with hidden window)
