Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Tencent SecurityHealth' = '"C:\Users\Public\qXHLhT\agVx8A.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\irblj
- <SYSTEM32>\tasks\task1
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\TCLService] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\TCLService] 'ImagePath' = '%WINDIR%\Temp\ranchserv.jpg'
Creates the following services
- 'TCLService' %WINDIR%\Temp\ranchserv.jpg
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] 'C:\Users\Public\qXHLhT' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] 'C:\Users' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] 'C:\Program Files (x86)' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%HOMEPATH%\Documents' = '00000000'
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force
Patches code
in NTDLL dll
- waiosg.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- C:\users\public\qxhlht\agvx8a.exe
- C:\users\public\qxhlht\uxenhance64.dll
- C:\users\public\qxhlht\msadox.tb
- C:\users\public\qxhlht\adoresd.dat
- %WINDIR%\temp\ranchserv.jpg
- unc\localhost\pipe\atsvc
- <SYSTEM32>\codeintegrity\sipolicy.p7b
- C:\users\public\music\destopbak.ini
- %ProgramFiles(x86)%\3iyqi3\j8eoww.exe
Sets the 'hidden' attribute to the following files
- C:\users\public\qxhlht\agvx8a.exe
- C:\users\public\qxhlht\uxenhance64.dll
- C:\users\public\qxhlht\msadox.tb
- C:\users\public\qxhlht\adoresd.dat
Deletes following files that it created itself
- <SYSTEM32>\tasks\task1
Network activity
Connects to
- '26####.###-cn-beijing.aliyuncs.com':443
- '19#.#32.214.172':80
- '14#.#5.118.133':80
- 'mm####.###-cn-hangzhou.aliyuncs.com':443
- '15#.#01.2.133':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?75##############
Other
- '26####.###-cn-beijing.aliyuncs.com':443
- 'mm####.###-cn-hangzhou.aliyuncs.com':443
UDP
- DNS ASK 26####.###-cn-beijing.aliyuncs.com
- DNS ASK mm####.###-cn-hangzhou.aliyuncs.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\qxhlht\agvx8a.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public...
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qXHLhT\" /t REG_DWO...
- '<SYSTEM32>\schtasks.exe' /Run /TN "Task1"
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qXHLhT" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ALLUSERSPROFIL...
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Task1" /F
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ALLUSERSPROFILE%\" /t REG_DWORD /d...
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t R...
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ProgramFiles(x...
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ProgramFiles(x86)%\" /t REG_DWORD ...
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\D...
- '<SYSTEM32>\schtasks.exe' /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%HOMEPATH%\Documents\" /t REG_DWORD...
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%HOMEPATH%\Documents" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qXHLhT" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%HOMEPATH%\Documents" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ALLUSERSPROFIL...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t R...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%ProgramFiles(x...' (with hidden window)
- '<SYSTEM32>\cmd.exe' cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\D...' (with hidden window)
