Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsRecovery' = '"%LOCALAPPDATA%\WindowsRecovery\Update.exe"'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\windowsrecovery\update.exe.tmp
- %APPDATA%\windowsframehost\runtimebroker.exe
Moves the following files
- from %LOCALAPPDATA%\windowsrecovery\update.exe.tmp to %LOCALAPPDATA%\windowsrecovery\update.exe
Network activity
Connects to
- 'do##in.cy':2083
TCP
Other
- 'do##in.cy':2083
UDP
- DNS ASK do##in.cy
Miscellaneous
Creates and executes the following
- '%APPDATA%\windowsframehost\runtimebroker.exe' --host auto.alphapool.tech --port 5561 --worker prl1paljcc9y74wec30weuvwdm29k9z049zvhxxd3fgzgpp46aw9sypfql2fyju.rltbwur-IntelRHDGraphics530 --password x --gpu 0
Executes the following
- '%APPDATA%\windowsframehost\runtimebroker.exe' --host auto.alphapool.tech --port 5561 --worker prl1paljcc9y74wec30weuvwdm29k9z049zvhxxd3fgzgpp46aw9sypfql2fyju.rltbwur-IntelRHDGraphics530 --password x --gpu 0' (with hidden window)
