Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\taskhostw
- <SYSTEM32>\tasks\fontdrvhost
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\csrss.exe
- %ProgramFiles(x86)%\internet explorer\services.exe
- %ProgramFiles(x86)%\windowspowershell\dwm.exe
- %ProgramFiles(x86)%\steam\taskhostw.exe
- %ProgramFiles(x86)%\windows mail\fontdrvhost.exe
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
Sets the 'hidden' attribute to the following files
- %TEMP%\csrss.exe
- %ProgramFiles(x86)%\internet explorer\services.exe
- %ProgramFiles(x86)%\windowspowershell\dwm.exe
- %ProgramFiles(x86)%\steam\taskhostw.exe
- %ProgramFiles(x86)%\windows mail\fontdrvhost.exe
Network activity
Connects to
- 'gi##ab.com':443
TCP
Other
- 'gi##ab.com':443
UDP
- DNS ASK dn#.google
- DNS ASK gi##ab.com
- 'dn#.google':443
- '19#.#26.99.166':443
- '17#.#2.71.122':443
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\windows mail\fontdrvhost.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe'
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s UmRdpService
- '%WINDIR%\syswow64\reagentc.exe' /disable
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' ' (with hidden window)
