Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'HostSvc' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'UpdateHost' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HelperTask' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinProc' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'AgentHost' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Loader32' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "<Full path to file>"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,"<Full path to file>"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{Helper32AgentAgent-lvrium}] 'StubPath' = '<Full path to file>'
- [HKCU\Environment] 'UserInitMprLogonScript' = '<Full path to file>'
- [HKCU\Software\Microsoft\Command Processor] 'AutoRun' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '<Full path to file>'
- [HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\Sys64] 'Driver' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\wintask
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\RuntimeMgr] 'ImagePath' = '<Full path to file>'
- [HKLM\SYSTEM\CurrentControlSet\Services\RuntimeMgr] 'Start' = '00000002'
Creates the following services
- 'RuntimeMgr' <Full path to file>
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
Modifies file system
Creates the following files
- %APPDATA%\31
- %APPDATA%\hosttask.exe
- nul
- %HOMEPATH%\desktop\runtimecore.exe
- %HOMEPATH%\documents\updateproc.exe
- %HOMEPATH%\downloads\loadersvc.exe
- %APPDATA%\updatesvc.exe
- %LOCALAPPDATA%\update64.exe
- %TEMP%\agent32.exe
- %TEMP%\helperhelper.exe
- %TEMP%\winhelper.exe
- %WINDIR%\temp\host32.exe
- <SYSTEM32>\coremgr.exe
- %WINDIR%\syswow64\runtimeagent.exe
- %WINDIR%\netagent.exe
- %ALLUSERSPROFILE%\nettask.exe
- C:\msproc.exe
- C:\users\public\hostmgr.exe
- C:\users\public\desktop\wintask.exe
- %ProgramFiles%\nethelper.exe
- %ProgramFiles(x86)%\helpercore.exe
- <SYSTEM32>\config\systemprofile\appdata\roaming\runtimetask.exe
- <SYSTEM32>\config\systemprofile\appdata\local\agent64.exe
- %WINDIR%\serviceprofiles\localservice\desktop\net64.exe
- %WINDIR%\serviceprofiles\localservice\appdata\roaming\updatemonitor.exe
- %WINDIR%\serviceprofiles\localservice\appdata\local\winsvc.exe
- %WINDIR%\serviceprofiles\networkservice\desktop\sysmgr.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\roaming\hostmgr.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\local\mssvc.exe
- %HOMEPATH%\desktop\svchelper.exe
- %APPDATA%\svchelper.exe
- %LOCALAPPDATA%\svc32.exe
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a40ac9f-e7c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a40aca6-10dc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a40ac9f-e7c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a40aca6-10dc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ca####.discord.com':443
- 'co####.edge.skype.com':443
- 'yo##ube.com':443
TCP
Other
- 'ap#.#pify.org':443
- 'ca####.discord.com':443
- 'co####.edge.skype.com':443
- 'yo##ube.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ca####.discord.com
- DNS ASK co####.edge.skype.com
- DNS ASK yo##ube.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start=disabled 2>nul
- '<SYSTEM32>\sc.exe' config WinDefend start=disabled
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend 2>nul
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet 2>nul
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /F /SC ONLOGON /TN "WinTask" /TR "\"%APPDATA%\HostTask.exe\"" /RL HIGHEST
- '<SYSTEM32>\schtasks.exe' /Create /F /SC ONLOGON /TN "WinTask" /TR "\"%APPDATA%\HostTask.exe\"" /RL HIGHEST
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.youtube.com/watch?v=H_WN-xTp7oU
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1788,7139935980238298028,3639575150979789286,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start=disabled 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /F /SC ONLOGON /TN "WinTask" /TR "\"%APPDATA%\HostTask.exe\"" /RL HIGHEST' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.youtube.com/watch?v=H_WN-xTp7oU' (with hidden window)