Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\MicrosoftDefenderBackup] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MicrosoftDefenderBackup] 'ImagePath' = '%PROGRAMDATA%\Microsoft\MicrosoftDefender\mwmc.exe'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%PROGRAMDATA%\Microsoft\MicrosoftDefender\WinRing0x64.sys'
Creates the following services
- 'MicrosoftDefenderBackup' %PROGRAMDATA%\Microsoft\MicrosoftDefender\mwmc.exe
- 'WinRing0_1_2_0' %PROGRAMDATA%\Microsoft\MicrosoftDefender\WinRing0x64.sys
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %PROGRAMDATA%\microsoft\microsoftdefender\mcmpeng.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\lixmvqoa\mcmpeng[1].exe
- %PROGRAMDATA%\microsoft\microsoftdefender\winring0x64.sys
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0ps72r2m\winring0x64[1].sys
- %PROGRAMDATA%\microsoft\microsoftdefender\config.json
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\62axopq5\config[1].json
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\low\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\q2ijnvvt\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\toagixb8\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\evklc5xq\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\mbil9bw6\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\fzg8ckj5\cmdrun[1].exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %PROGRAMDATA%\microsoft\microsoftdefender\mwmc.exe
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\lhj68maf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hq278rqz\desktop.ini
- %PROGRAMDATA%\microsoft\microsoftdefender\wudhost.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0s9bsrs8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\w5v6l8d1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %PROGRAMDATA%\microsoft\microsoftdefender\cmdrun.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\q2ijnvvt\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\toagixb8\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\evklc5xq\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\mbil9bw6\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\history.ie5\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\lhj68maf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hq278rqz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0s9bsrs8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\w5v6l8d1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\low\desktop.ini
Deletes itself.
Network activity
Connects to
- '79.##4.62.21':8
TCP
HTTP GET requests
- http://79.##4.62.21/Microsoft/64/WUDHost.exe
- http://79.##4.62.21/Microsoft/mwmc.exe
- http://79.##4.62.21/Microsoft/64/config.json
- http://79.##4.62.21/Microsoft/64/WinRing0x64.sys
- http://79.##4.62.21/Microsoft/64/McMpEng.exe
- http://79.##4.62.21/Microsoft/64/CmdRun.exe
- http://79.##4.62.21/Microsoft/mwc.exe
HTTP POST requests
- /client/setClientConfig?cl################## via 79.##4.62.21
- /client/setClientStatus?cl################## via 79.##4.62.21
Miscellaneous
Searches for the following windows
- ClassName: 'BUTTON' WindowName: ''
Creates and executes the following
- '%PROGRAMDATA%\microsoft\microsoftdefender\mcmpeng.exe' --daemonized
- '%PROGRAMDATA%\microsoft\microsoftdefender\mwmc.exe' install MicrosoftDefenderBackup %PROGRAMDATA%\Microsoft\MicrosoftDefender\WUDHost.exe
- '%PROGRAMDATA%\microsoft\microsoftdefender\mwmc.exe' start MicrosoftDefenderBackup
- '%PROGRAMDATA%\microsoft\microsoftdefender\mwmc.exe'
- '%PROGRAMDATA%\microsoft\microsoftdefender\wudhost.exe'
- '%PROGRAMDATA%\microsoft\microsoftdefender\mwmc.exe' set MicrosoftDefenderBackup start SERVICE_AUTO_START
- '%PROGRAMDATA%\microsoft\microsoftdefender\cmdrun.exe'
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "Users:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwc start WindowsDefender' (with hidden window)
- '%PROGRAMDATA%\microsoft\microsoftdefender\cmdrun.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwc set WindowsDefender start SERVICE_AUTO_START && mwc start WindowsDefender' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwmc set MicrosoftDefenderBackup start SERVICE_AUTO_START && mwmc start MicrosoftDefenderBackup' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwc install WindowsDefender %PROGRAMDATA%\Microsoft\MicrosoftDefender\winlogon.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "Administrators:(R,REA,RA))"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 localhost < nul & del /F /Q "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwmc start MicrosoftDefenderBackup' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "%username%:(R,REA,RA)"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwmc install MicrosoftDefenderBackup %PROGRAMDATA%\Microsoft\MicrosoftDefender\WUDHost.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwmc install MicrosoftDefenderBackup %PROGRAMDATA%\Microsoft\MicrosoftDefender\WUDHost.exe
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwmc start MicrosoftDefenderBackup
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwmc set MicrosoftDefenderBackup start SERVICE_AUTO_START && mwmc start MicrosoftDefenderBackup
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 localhost < nul & del /F /Q "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' -n 5 localhost
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwc install WindowsDefender %PROGRAMDATA%\Microsoft\MicrosoftDefender\winlogon.exe
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwc start WindowsDefender
- '%WINDIR%\syswow64\cmd.exe' /c cd %PROGRAMDATA%\Microsoft\MicrosoftDefender && mwc set WindowsDefender start SERVICE_AUTO_START && mwc start WindowsDefender
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "%username%:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "Users:(R,REA,RA)"
- '%WINDIR%\syswow64\cmd.exe' /c icacls %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "Administrators:(R,REA,RA))"
- '<SYSTEM32>\cmd.exe' /c "%PROGRAMDATA%\Microsoft\MicrosoftDefender\McMpEng.exe" --daemonized
- '%WINDIR%\syswow64\icacls.exe' %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "rusekovkydl$:(R,REA,RA)"
- '%WINDIR%\syswow64\icacls.exe' %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "Users:(R,REA,RA)"
- '%WINDIR%\syswow64\icacls.exe' %PROGRAMDATA%\Microsoft\MicrosoftDefender /deny "Administrators:(R,REA,RA))"