Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Security' = 'C:\MicrosoftSecurity\PhoneExperienceHostmd.exe exec hide "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "C...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Security' = 'C:\MicrosoftSecurity\PhoneExperienceHostmd.exe exec hide "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "C:\MicrosoftS...
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftOffice' = 'C:\MicrosoftSecurity\PhoneExperienceHostmd.exe exec hide "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "C:\M...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Cortana' = 'C:\MicrosoftSecurity\PhoneExperienceHostmd.exe exec hide "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "C:\MicrosoftSecurity\Mic...
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'HDAudio' = 'C:\MicrosoftSecurity\PhoneExperienceHostmd.exe exec hide "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "C:\Microsoft...
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'PrintDriver' = 'C:\MicrosoftSecurity\PhoneExperienceHostmd.exe exec hide "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "C:\MicrosoftSecurity...
Creates the following files on removable media
- <Drive name for removable media>:\microsoft\microsoft.a3x
- <Drive name for removable media>:\microsoft\microsoftsecurity.exe
- <Drive name for removable media>:\microsoft\microsoftsecurity.lnk
- <Drive name for removable media>:\microsoft\music.lnk
- <Drive name for removable media>:\microsoft\phoneexperiencehostmd.exe
- <Drive name for removable media>:\microsoft\pictures.lnk
- <Drive name for removable media>:\microsoft\reports.lnk
- <Drive name for removable media>:\microsoft\statments.lnk
- <Drive name for removable media>:\microsoft\microsoft\microsoft.a3x
- <Drive name for removable media>:\microsoft\microsoft\microsoftsecurity.exe
- <Drive name for removable media>:\microsoft\microsoft\phoneexperiencehostmd.exe
- <Drive name for removable media>:\microsoft\microsoft\soiu.us
- <Drive name for removable media>:\microsoft\soiu.us
- <Drive name for removable media>:\microsoft\microsoft\microsoftsecurity.lnk
- <Drive name for removable media>:\microsoft\microsoft\music.lnk
- <Drive name for removable media>:\microsoft\microsoft\pictures.lnk
- <Drive name for removable media>:\microsoft\microsoft\reports.lnk
- <Drive name for removable media>:\microsoft\microsoft\statments.lnk
- <Drive name for removable media>:\microsoft\microsoft\microsoft\microsoft.a3x
- <Drive name for removable media>:\microsoft\microsoft\microsoft\microsoftsecurity.exe
- <Drive name for removable media>:\microsoft\microsoft\microsoft\phoneexperiencehostmd.exe
- <Drive name for removable media>:\microsoft\microsoft\microsoft\soiu.us
- <Drive name for removable media>:\microsoft\microsoft.lnk
- <Drive name for removable media>:\documents.lnk
- <Drive name for removable media>:\downloads.lnk
- <Drive name for removable media>:\screenshots.lnk
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "MicrosoftSecurity.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\autcb89.tmp
- C:\microsoftsecurity\phoneexperiencehostmd.exe
- %TEMP%\autcba9.tmp
- C:\microsoftsecurity\microsoftsecurity.exe
- %TEMP%\autcc27.tmp
- C:\microsoftsecurity\microsoft.a3x
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\microsoft security.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\microsoftupdate.lnk
- C:\microsoft\microsoft.a3x
- C:\microsoft\microsoftsecurity.exe
- C:\microsoft\phoneexperiencehostmd.exe
- C:\microsoft\soiu.us
- C:\documents and settings\microsoft\microsoft.a3x
- C:\documents and settings\microsoft\microsoftsecurity.exe
- C:\documents and settings\microsoft\phoneexperiencehostmd.exe
- C:\documents and settings\microsoft\soiu.us
- C:\documents and settings\documents and settings.lnk
- C:\documents and settings\music.lnk
- C:\documents and settings\pictures.lnk
- C:\documents and settings\reports.lnk
- C:\documents and settings\statments.lnk
- C:\kms\microsoft\microsoft.a3x
- C:\kms\microsoft\microsoftsecurity.exe
- C:\kms\microsoft\phoneexperiencehostmd.exe
- C:\kms\microsoft\soiu.us
- C:\kms\kms.lnk
- C:\kms\music.lnk
- C:\kms\pictures.lnk
- C:\kms\reports.lnk
- C:\kms\statments.lnk
- C:\microsoft\microsoft\microsoft.a3x
- C:\microsoft\microsoft\microsoftsecurity.exe
- C:\microsoft\microsoft\phoneexperiencehostmd.exe
- C:\microsoft\microsoft\soiu.us
- C:\microsoft\microsoft.lnk
- C:\microsoft\music.lnk
- C:\microsoft\pictures.lnk
- C:\microsoft\reports.lnk
- C:\microsoft\statments.lnk
- C:\microsoftsecurity\microsoft\microsoft.a3x
- C:\microsoftsecurity\microsoft\microsoftsecurity.exe
- C:\microsoftsecurity\microsoft\phoneexperiencehostmd.exe
- C:\microsoftsecurity\microsoft\soiu.us
- C:\microsoftsecurity\microsoftsecurity.lnk
- C:\microsoftsecurity\music.lnk
- C:\microsoftsecurity\pictures.lnk
- C:\microsoftsecurity\reports.lnk
- C:\microsoftsecurity\statments.lnk
- C:\msocache\microsoft\microsoft.a3x
- C:\msocache\microsoft\microsoftsecurity.exe
- C:\msocache\microsoft\microsoftsecurity.lnk
- C:\msocache\microsoft\music.lnk
- C:\msocache\microsoft\phoneexperiencehostmd.exe
- C:\msocache\microsoft\pictures.lnk
- C:\msocache\microsoft\reports.lnk
- C:\msocache\microsoft\statments.lnk
- C:\msocache\microsoft\microsoft\microsoft.a3x
- C:\msocache\microsoft\microsoft\microsoftsecurity.exe
- C:\msocache\microsoft\microsoft\phoneexperiencehostmd.exe
- C:\msocache\microsoft\microsoft\soiu.us
- C:\msocache\microsoft\soiu.us
- C:\msocache\msocache.lnk
- C:\msocache\music.lnk
- C:\msocache\pictures.lnk
- C:\msocache\reports.lnk
- C:\msocache\statments.lnk
- C:\perflogs\microsoft\microsoft.a3x
- C:\perflogs\microsoft\microsoftsecurity.exe
- C:\perflogs\microsoft\microsoftsecurity.lnk
- C:\perflogs\microsoft\music.lnk
- C:\perflogs\microsoft\phoneexperiencehostmd.exe
- C:\perflogs\microsoft\pictures.lnk
- C:\perflogs\microsoft\reports.lnk
- C:\perflogs\microsoft\statments.lnk
- C:\perflogs\microsoft\microsoft\microsoft.a3x
- C:\perflogs\microsoft\microsoft\microsoftsecurity.exe
- C:\perflogs\microsoft\microsoft\phoneexperiencehostmd.exe
- C:\perflogs\microsoft\microsoft\soiu.us
- C:\perflogs\microsoft\soiu.us
- C:\perflogs\perflogs.lnk
- C:\perflogs\music.lnk
- C:\perflogs\pictures.lnk
- C:\perflogs\reports.lnk
- C:\perflogs\statments.lnk
- <Current directory>\microsoft\microsoft.a3x
- <Current directory>\microsoft\microsoftsecurity.exe
- <Current directory>\microsoft\microsoftsecurity.lnk
- <Current directory>\microsoft\music.lnk
- <Current directory>\microsoft\phoneexperiencehostmd.exe
- <Current directory>\microsoft\pictures.lnk
- <Current directory>\microsoft\reports.lnk
- <Current directory>\microsoft\statments.lnk
- <Current directory>\microsoft\microsoft\microsoft.a3x
- <Current directory>\microsoft\microsoft\microsoftsecurity.exe
- <Current directory>\microsoft\microsoft\phoneexperiencehostmd.exe
- <Current directory>\microsoft\microsoft\soiu.us
- <Current directory>\microsoft\soiu.us
- <Current directory>\pkrbj.lnk
- <Current directory>\music.lnk
- <Current directory>\pictures.lnk
- <Current directory>\reports.lnk
- <Current directory>\statments.lnk
- %ProgramFiles%\microsoft\microsoft.a3x
- %ProgramFiles%\microsoft\microsoftsecurity.exe
- %ProgramFiles%\microsoft\microsoftsecurity.lnk
- %ProgramFiles%\microsoft\music.lnk
- %ProgramFiles%\microsoft\phoneexperiencehostmd.exe
- %ProgramFiles%\microsoft\pictures.lnk
- %ProgramFiles%\microsoft\reports.lnk
- %ProgramFiles%\microsoft\statments.lnk
- %ProgramFiles%\microsoft\microsoft\microsoft.a3x
- %ProgramFiles%\microsoft\microsoft\microsoftsecurity.exe
- %ProgramFiles%\microsoft\microsoft\phoneexperiencehostmd.exe
- %ProgramFiles%\microsoft\microsoft\soiu.us
- %ProgramFiles%\microsoft\soiu.us
- %ProgramFiles%\program files.lnk
- %ProgramFiles%\music.lnk
- %ProgramFiles%\pictures.lnk
- %ProgramFiles%\reports.lnk
- %ProgramFiles%\statments.lnk
- %ProgramFiles(x86)%\microsoft\microsoft.a3x
- %ProgramFiles(x86)%\microsoft\microsoftsecurity.exe
- %ProgramFiles(x86)%\microsoft\microsoftsecurity.lnk
- %ProgramFiles(x86)%\microsoft\music.lnk
- %ProgramFiles(x86)%\microsoft\phoneexperiencehostmd.exe
- %ProgramFiles(x86)%\microsoft\pictures.lnk
- %ProgramFiles(x86)%\microsoft\reports.lnk
- %ProgramFiles(x86)%\microsoft\statments.lnk
- %ProgramFiles(x86)%\microsoft\microsoft\microsoft.a3x
- %ProgramFiles(x86)%\microsoft\microsoft\microsoftsecurity.exe
- %ProgramFiles(x86)%\microsoft\microsoft\phoneexperiencehostmd.exe
- %ProgramFiles(x86)%\microsoft\microsoft\soiu.us
- %ProgramFiles(x86)%\microsoft\soiu.us
- %ProgramFiles(x86)%\program files (x86).lnk
- %ProgramFiles(x86)%\music.lnk
- %ProgramFiles(x86)%\pictures.lnk
- %ProgramFiles(x86)%\reports.lnk
- %ProgramFiles(x86)%\statments.lnk
- %ALLUSERSPROFILE%\microsoft\microsoft.a3x
- %ALLUSERSPROFILE%\microsoft\microsoftsecurity.exe
- %ALLUSERSPROFILE%\microsoft\microsoftsecurity.lnk
- %ALLUSERSPROFILE%\microsoft\music.lnk
- %ALLUSERSPROFILE%\microsoft\phoneexperiencehostmd.exe
- %ALLUSERSPROFILE%\microsoft\pictures.lnk
- %ALLUSERSPROFILE%\microsoft\reports.lnk
- %ALLUSERSPROFILE%\microsoft\statments.lnk
- %ALLUSERSPROFILE%\microsoft\microsoft\microsoft.a3x
- %ALLUSERSPROFILE%\microsoft\microsoft\microsoftsecurity.exe
- %ALLUSERSPROFILE%\microsoft\microsoft\phoneexperiencehostmd.exe
- %ALLUSERSPROFILE%\microsoft\microsoft\soiu.us
- %ALLUSERSPROFILE%\microsoft\soiu.us
- %ALLUSERSPROFILE%\programdata.lnk
- %ALLUSERSPROFILE%\music.lnk
- %ALLUSERSPROFILE%\pictures.lnk
- %ALLUSERSPROFILE%\reports.lnk
- %ALLUSERSPROFILE%\statments.lnk
- C:\recovery\microsoft\microsoft.a3x
- C:\recovery\microsoft\microsoftsecurity.exe
- C:\recovery\microsoft\microsoftsecurity.lnk
- C:\recovery\microsoft\music.lnk
- C:\recovery\microsoft\phoneexperiencehostmd.exe
- C:\recovery\microsoft\pictures.lnk
- C:\recovery\microsoft\reports.lnk
- C:\recovery\microsoft\statments.lnk
- C:\recovery\microsoft\microsoft\microsoft.a3x
- C:\recovery\microsoft\microsoft\microsoftsecurity.exe
- C:\recovery\microsoft\microsoft\phoneexperiencehostmd.exe
- C:\recovery\microsoft\microsoft\soiu.us
- C:\recovery\microsoft\soiu.us
- C:\recovery\recovery.lnk
- C:\recovery\music.lnk
- C:\recovery\pictures.lnk
- C:\recovery\reports.lnk
- C:\recovery\statments.lnk
- C:\users\microsoft\microsoft.a3x
- C:\users\microsoft\microsoftsecurity.exe
- C:\users\microsoft\microsoftsecurity.lnk
- C:\users\microsoft\music.lnk
- C:\users\microsoft\phoneexperiencehostmd.exe
- C:\users\microsoft\pictures.lnk
- C:\users\microsoft\reports.lnk
- C:\users\microsoft\statments.lnk
- C:\users\microsoft\microsoft\microsoft.a3x
- C:\users\microsoft\microsoft\microsoftsecurity.exe
- C:\users\microsoft\microsoft\phoneexperiencehostmd.exe
- C:\users\microsoft\microsoft\soiu.us
- C:\users\microsoft\soiu.us
- %HOMEPATH%s.lnk
- C:\users\music.lnk
- C:\users\pictures.lnk
- C:\users\reports.lnk
- C:\users\statments.lnk
- %WINDIR%\microsoft\microsoft.a3x
- %WINDIR%\microsoft\microsoftsecurity.exe
- %WINDIR%\microsoft\microsoftsecurity.lnk
- %WINDIR%\microsoft\music.lnk
- %WINDIR%\microsoft\phoneexperiencehostmd.exe
- %WINDIR%\microsoft\pictures.lnk
- %WINDIR%\microsoft\reports.lnk
- %WINDIR%\microsoft\statments.lnk
- %WINDIR%\microsoft\microsoft\microsoft.a3x
- %WINDIR%\microsoft\microsoft\microsoftsecurity.exe
- %WINDIR%\microsoft\microsoft\phoneexperiencehostmd.exe
- %WINDIR%\microsoft\microsoft\soiu.us
- %WINDIR%\microsoft\soiu.us
- %WINDIR%\windows.lnk
- %WINDIR%\music.lnk
- %WINDIR%\pictures.lnk
- %WINDIR%\reports.lnk
- %WINDIR%\statments.lnk
- D:\microsoft\microsoft.a3x
- D:\microsoft\microsoftsecurity.exe
- D:\microsoft\microsoftsecurity.lnk
- D:\microsoft\music.lnk
- D:\microsoft\phoneexperiencehostmd.exe
- D:\microsoft\pictures.lnk
- D:\microsoft\reports.lnk
- D:\microsoft\statments.lnk
- D:\microsoft\microsoft\microsoft.a3x
- D:\microsoft\microsoft\microsoftsecurity.exe
- D:\microsoft\microsoft\phoneexperiencehostmd.exe
- D:\microsoft\microsoft\soiu.us
- D:\microsoft\soiu.us
- D:\microsoft\microsoft\microsoftsecurity.lnk
- D:\microsoft\microsoft\music.lnk
- D:\microsoft\microsoft\pictures.lnk
- D:\microsoft\microsoft\reports.lnk
- D:\microsoft\microsoft\statments.lnk
- D:\microsoft\microsoft\microsoft\microsoft.a3x
- D:\microsoft\microsoft\microsoft\microsoftsecurity.exe
- D:\microsoft\microsoft\microsoft\phoneexperiencehostmd.exe
- D:\microsoft\microsoft\microsoft\soiu.us
- D:\microsoft\microsoft.lnk
Deletes following files that it created itself
- %TEMP%\autcb89.tmp
- %TEMP%\autcba9.tmp
- %TEMP%\autcc27.tmp
Network activity
Connects to
- 'go#######viceads.publicvm.com':223
UDP
- DNS ASK go#######viceads.publicvm.com
Miscellaneous
Creates and executes the following
- 'C:\microsoftsecurity\microsoftsecurity.exe' C:\MicrosoftSecurity\Microsoft.a3x
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\MicrosoftSecurity\MicrosoftSecurity.exe" "MicrosoftSecurity.exe" ENABLE' (with hidden window)