Technical Information
Triggers a user-defined sigma rule:
- 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
- 5e993621-67d4-488a-b9ae-b420d08b96cb
- cea72823-df4d-4567-950c-0b579eaf0846
- 1228c958-e64e-4e71-92ad-7d429f4138ba
- a6a39bdb-935c-4f0a-ab77-35f4bbf44d33
- db809f10-56ce-4420-8c86-d6a7d793c79c
- 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
- 92626ddd-662c-49e3-ac59-f6535f12d189
- 81325ce1-be01-4250-944f-b4789644556f
- 7a02e22e-b885-4404-b38b-1ddc7e65258a
- 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
- d223b46b-5621-4037-88fe-fda32eead684
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Real-time Protection' = '%APPDATA%\Microsoft\WinRealtimeprot.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftrealtimeprotection
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRealtimeprot] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRealtimeprot] 'ImagePath' = '%APPDATA%\Microsoft\WinRealtimeprot.exe -service'
Creates the following services
- 'WinRealtimeprot' %APPDATA%\Microsoft\WinRealtimeprot.exe -service
Creates the following files on removable media
- <Drive name for removable media>:\winrealtimeprot.exe
- <Drive name for removable media>:\autorun.inf
Modifies master boot record (MBR).
Malicious functions
Patches code
in AMSI dll
- gwbfrcvf.exe process, Amsi.dll module
in NTDLL dll
- gwbfrcvf.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %APPDATA%\microsoft\winrealtimeprot.exe
- %TEMP%\wmi.vbs
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\winrealtimeprot.exe
- <Drive name for removable media>:\autorun.inf
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "MicrosoftRealTimeProtection" /tr "%APPDATA%\Microsoft\WinRealtimeprot.exe" /sc ONLOGON /rl HIGHEST /f
- '<SYSTEM32>\wscript.exe' /B %TEMP%\\wmi.vbs
- '<SYSTEM32>\schtasks.exe' /create /tn "MicrosoftRealTimeProtection" /tr "%APPDATA%\Microsoft\WinRealtimeprot.exe" /sc ONLOGON /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "MicrosoftRealTimeProtection" /tr "%APPDATA%\Microsoft\WinRealtimeprot.exe" /sc ONLOGON /rl HIGHEST /f' (with hidden window)
- '<SYSTEM32>\wscript.exe' /B %TEMP%\\wmi.vbs' (with hidden window)
