Technical Information
Triggers a user-defined sigma rule:
- 92626ddd-662c-49e3-ac59-f6535f12d189
- 81325ce1-be01-4250-944f-b4789644556f
- 7a02e22e-b885-4404-b38b-1ddc7e65258a
- f4bbd493-b796-416e-bbf2-121235348529
- 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsthemeservice
Malicious functions
Injects code into
the following user processes:
- setup.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\nsq2bf5.tmp
- %TEMP%\nsf2c05.tmp\system.dll
- %LOCALAPPDATA%\programs\setup\license.electron.txt
- %LOCALAPPDATA%\programs\setup\licenses.chromium.html
- %LOCALAPPDATA%\programs\setup\chrome_100_percent.pak
- %LOCALAPPDATA%\programs\setup\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\setup\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\setup\dxcompiler.dll
- %LOCALAPPDATA%\programs\setup\dxil.dll
- %LOCALAPPDATA%\programs\setup\ffmpeg.dll
- %LOCALAPPDATA%\programs\setup\icudtl.dat
- %LOCALAPPDATA%\programs\setup\libegl.dll
- %LOCALAPPDATA%\programs\setup\libglesv2.dll
- %LOCALAPPDATA%\programs\setup\resources.pak
- %LOCALAPPDATA%\programs\setup\setup.exe
- %LOCALAPPDATA%\programs\setup\snapshot_blob.bin
- %LOCALAPPDATA%\programs\setup\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\setup\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\setup\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\setup\vulkan-1.dll
- %LOCALAPPDATA%\programs\setup\locales\af.pak
- %LOCALAPPDATA%\programs\setup\locales\am.pak
- %LOCALAPPDATA%\programs\setup\locales\ar.pak
- %LOCALAPPDATA%\programs\setup\locales\bg.pak
- %LOCALAPPDATA%\programs\setup\locales\bn.pak
- %LOCALAPPDATA%\programs\setup\locales\ca.pak
- %LOCALAPPDATA%\programs\setup\locales\cs.pak
- %LOCALAPPDATA%\programs\setup\locales\da.pak
- %LOCALAPPDATA%\programs\setup\locales\de.pak
- %LOCALAPPDATA%\programs\setup\locales\el.pak
- %LOCALAPPDATA%\programs\setup\locales\en-gb.pak
- %LOCALAPPDATA%\programs\setup\locales\en-us.pak
- %LOCALAPPDATA%\programs\setup\locales\es-419.pak
- %LOCALAPPDATA%\programs\setup\locales\es.pak
- %LOCALAPPDATA%\programs\setup\locales\et.pak
- %LOCALAPPDATA%\programs\setup\locales\fa.pak
- %LOCALAPPDATA%\programs\setup\locales\fi.pak
- %LOCALAPPDATA%\programs\setup\locales\fil.pak
- %LOCALAPPDATA%\programs\setup\locales\fr.pak
- %LOCALAPPDATA%\programs\setup\locales\gu.pak
- %LOCALAPPDATA%\programs\setup\locales\he.pak
- %LOCALAPPDATA%\programs\setup\locales\hi.pak
- %LOCALAPPDATA%\programs\setup\locales\hr.pak
- %LOCALAPPDATA%\programs\setup\locales\hu.pak
- %LOCALAPPDATA%\programs\setup\locales\id.pak
- %LOCALAPPDATA%\programs\setup\locales\it.pak
- %LOCALAPPDATA%\programs\setup\locales\ja.pak
- %LOCALAPPDATA%\programs\setup\locales\kn.pak
- %LOCALAPPDATA%\programs\setup\locales\ko.pak
- %LOCALAPPDATA%\programs\setup\locales\lt.pak
- %LOCALAPPDATA%\programs\setup\locales\lv.pak
- %LOCALAPPDATA%\programs\setup\locales\ml.pak
- %LOCALAPPDATA%\programs\setup\locales\mr.pak
- %LOCALAPPDATA%\programs\setup\locales\ms.pak
- %LOCALAPPDATA%\programs\setup\locales\nb.pak
- %LOCALAPPDATA%\programs\setup\locales\nl.pak
- %LOCALAPPDATA%\programs\setup\locales\pl.pak
- %LOCALAPPDATA%\programs\setup\locales\pt-br.pak
- %LOCALAPPDATA%\programs\setup\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\setup\locales\ro.pak
- %LOCALAPPDATA%\programs\setup\locales\ru.pak
- %LOCALAPPDATA%\programs\setup\locales\sk.pak
- %LOCALAPPDATA%\programs\setup\locales\sl.pak
- %LOCALAPPDATA%\programs\setup\locales\sr.pak
- %LOCALAPPDATA%\programs\setup\locales\sv.pak
- %LOCALAPPDATA%\programs\setup\locales\sw.pak
- %LOCALAPPDATA%\programs\setup\locales\ta.pak
- %LOCALAPPDATA%\programs\setup\locales\te.pak
- %LOCALAPPDATA%\programs\setup\locales\th.pak
- %LOCALAPPDATA%\programs\setup\locales\tr.pak
- %LOCALAPPDATA%\programs\setup\locales\uk.pak
- %LOCALAPPDATA%\programs\setup\locales\ur.pak
- %LOCALAPPDATA%\programs\setup\locales\vi.pak
- %LOCALAPPDATA%\programs\setup\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\setup\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\setup\resources\app.asar
- %LOCALAPPDATA%\programs\setup\resources\app.asar.unpacked\output.js
- %LOCALAPPDATA%\programs\setup\<File name>.exe
- %TEMP%\nsf2c05.tmp\nsexec.dll
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\programs\setup\setup.exe'
- '%LOCALAPPDATA%\programs\setup\setup.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\setup" --field-trial-handle=1680,i,6162903610463137280,8282783...
- '%LOCALAPPDATA%\programs\setup\setup.exe' --type=gpu-process --user-data-dir="%APPDATA%\setup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== -...
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "WindowsThemeService" /tr "\"%LOCALAPPDATA%\Programs\setup\setup.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "WindowsThemeService" /tr "\"%LOCALAPPDATA%\Programs\setup\setup.exe\"" /sc onlogon /rl highest /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""' (with hidden window)