Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows security policy
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\DotHostF7ED.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\Content.IE5\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Caches\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Caches\96560317\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\96560317\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\98DD\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\8CF7B530\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\49758347\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'InstallUtil.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'RegAsm.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'RegSvcs.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MSBuild.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'AppLaunch.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'AddInProcess.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'aspnet_compiler.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'RuntimeBroker91FC.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'DotHostF7ED.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'RuntimeHostDev.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'lolMiner.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'peakminer.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'bzminer.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'krig-miner.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'gminer.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'miniZ.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\DotHostF7ED.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\Content.IE5\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Caches\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Caches\96560317\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\96560317\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\98DD\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\8CF7B530\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\49758347\' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'InstallUtil.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'RegAsm.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'RegSvcs.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MSBuild.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'AppLaunch.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'AddInProcess.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'aspnet_compiler.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'RuntimeBroker91FC.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'DotHostF7ED.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'RuntimeHostDev.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'lolMiner.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'peakminer.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'bzminer.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'krig-miner.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'gminer.exe' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miniZ.exe' = '00000000'
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\','%ALLUSERSPROFILE%\Micr...
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RuntimeCache" dir=in action=allow remoteip=127.0.0.1 enable=yes profile=any
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\clr\usagelogs\479dd602\~w146a9674
- %LOCALAPPDATA%\microsoft\clr\usagelogs\479dd602\desktop.ini
- %LOCALAPPDATA%\microsoft\clr\usagelogs\479dd602\desktop.ini:index.dat
- %ALLUSERSPROFILE%\microsoft\windows\caches\log.txt
- %ALLUSERSPROFILE%\microsoft\windows\caches\96560317\dothostf7ed.exe
- %ALLUSERSPROFILE%\microsoft\windows\caches\96560317\wsc.ps1
- %ALLUSERSPROFILE%\microsoft\windows\caches\96560317\wsc.cmd
- %TEMP%\wsc_864d4584.xml
- %TEMP%\wsc_c6a9fac0.xml
- %WINDIR%\temp\__psscriptpolicytest_1gbxbotu.n2a.ps1
- %WINDIR%\temp\__psscriptpolicytest_fpzorjn0.bok.psm1
- %WINDIR%\temp\__psscriptpolicytest_biu4pxvm.kan.ps1
- %WINDIR%\temp\__psscriptpolicytest_fskn0b50.44t.psm1
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\clr\usagelogs\479dd602\desktop.ini
- %ALLUSERSPROFILE%\microsoft\windows\caches\96560317\dothostf7ed.exe
- %ALLUSERSPROFILE%\microsoft\windows\caches\96560317\wsc.ps1
- %ALLUSERSPROFILE%\microsoft\windows\caches\96560317\wsc.cmd
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\clr\usagelogs\479dd602\~w146a9674
- %TEMP%\wsc_864d4584.xml
- %TEMP%\wsc_c6a9fac0.xml
- %WINDIR%\temp\__psscriptpolicytest_1gbxbotu.n2a.ps1
- %WINDIR%\temp\__psscriptpolicytest_fpzorjn0.bok.psm1
- %WINDIR%\temp\__psscriptpolicytest_biu4pxvm.kan.ps1
- %WINDIR%\temp\__psscriptpolicytest_fskn0b50.44t.psm1
Network activity
Connects to
- 'ai######rd-chat.duckdns.org':8443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ai######rd-chat.duckdns.org':8443
UDP
- DNS ASK ai######rd-chat.duckdns.org
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\wsc.ps1"
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Windows Security Policy" /xml "%TEMP%\wsc_864d4584.xml" /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Windows Security Policy" /xml "%TEMP%\wsc_c6a9fac0.xml" /f
- '%WINDIR%\syswow64\schtasks.exe' /run /tn "Windows Security Policy"
- '<SYSTEM32>\cmd.exe' /c "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\96560317\wsc.cmd"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHost" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHost-Lock" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHost" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHost-Lock" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHostDev" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHostDev-Lock" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHostDev" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeHostDev-Lock" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost-Lock" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost-Lock" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost-StratumLock" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost-StratumLock-Lock" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost-StratumLock" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost-StratumLock-Lock" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinSysCacheUpdate" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinSysCacheUpdate-Lock" dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinSysCacheUpdate" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinSysCacheUpdate-Lock" dir=out
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="RuntimeCache" dir=in