Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '"%WINDIR%\SysWOW64\System\Secure System.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\update
- <SYSTEM32>\tasks\windowssystemhost
Modifies file system
Creates the following files
- %WINDIR%\sop tokengen.exe
- %TEMP%\_mei27922\docutils\parsers\rst\include\isopub.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isotech.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\mmlalias.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\mmlextra-wide.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\mmlextra.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\s5defs.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\xhtml1-lat1.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\xhtml1-special.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\xhtml1-symbol.txt
- %TEMP%\_mei27922\docutils\writers\html4css1\html4css1.css
- %TEMP%\_mei27922\docutils\writers\pep_html\pep.css
- %TEMP%\_mei27922\docutils\parsers\rst\include\isonum.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isomscr.txt
- %TEMP%\_mei27922\docutils\writers\html5_polyglot\plain.css
- %TEMP%\_mei27922\docutils\writers\html5_polyglot\responsive.css
- %TEMP%\_mei27922\docutils\writers\html5_polyglot\template.txt
- %TEMP%\_mei27922\docutils\writers\html5_polyglot\tuftig.css
- %TEMP%\_mei27922\docutils\writers\latex2e\default.tex
- %TEMP%\_mei27922\docutils\writers\latex2e\docutils.sty
- %TEMP%\_mei27922\docutils\writers\latex2e\titlepage.tex
- %TEMP%\_mei27922\docutils\writers\latex2e\titlingpage.tex
- %TEMP%\_mei27922\docutils\writers\latex2e\xelatex.tex
- %TEMP%\_mei27922\docutils\writers\odf_odt\styles.odt
- %TEMP%\_mei27922\docutils\writers\html4css1\template.txt
- %TEMP%\_mei27922\docutils\writers\html5_polyglot\minimal.css
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\license.psf
- %TEMP%\_mei27922\docutils\writers\html5_polyglot\math.css
- %TEMP%\_mei27922\docutils\parsers\rst\include\isocyr1.txt
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\record
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\wheel
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\top_level.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\readme.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isoamsa.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isoamsb.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isoamsc.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isoamsn.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isoamso.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isoamsr.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isomopf-wide.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isomscr-wide.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isomopf.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isodia.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isogrk1.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isogrk2.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isogrk3.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isogrk4-wide.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isogrk4.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isolat1.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isolat2.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isomfrk-wide.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isomfrk.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isobox.txt
- %TEMP%\_mei27922\docutils\parsers\rst\include\isocyr2.txt
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\metadata
- %TEMP%\_mei27922\docutils\writers\pep_html\template.txt
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\big-black\pretty.css
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\record
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\wheel
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\entry_points.txt
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\top_level.txt
- %TEMP%\_mei27922\lz4-4.0.1.dist-info\installer
- %TEMP%\_mei27922\lz4-4.0.1.dist-info\license
- %TEMP%\_mei27922\lz4-4.0.1.dist-info\metadata
- %TEMP%\_mei27922\lz4-4.0.1.dist-info\record
- %TEMP%\_mei27922\lz4-4.0.1.dist-info\wheel
- %TEMP%\_mei27922\lz4-4.0.1.dist-info\top_level.txt
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\license
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\metadata
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\installer
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\record
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\wheel
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\entry_points.txt
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\top_level.txt
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\installer
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\license.txt
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\metadata
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\record
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\wheel
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\entry_points.txt
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\license
- %TEMP%\_mei27922\setuptools-60.10.0.dist-info\metadata
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\big-black\__base__
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\readme.txt
- %TEMP%\_mei27922\importlib_metadata-4.11.3.dist-info\wheel
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\big-white\framing.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\big-white\pretty.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\framing.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\opera.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\outline.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\pretty.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\print.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\s5-core.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\slides.css
- %TEMP%\_mei27922\importlib_metadata-4.11.3.dist-info\top_level.txt
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\big-black\framing.css
- %TEMP%\_mei27922\keyring-23.5.1.dist-info\installer
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\default\slides.js
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\medium-white\pretty.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\small-black\__base__
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\small-black\pretty.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\small-white\framing.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\small-white\pretty.css
- %TEMP%\_mei27922\importlib_metadata-4.11.3.dist-info\installer
- %TEMP%\_mei27922\importlib_metadata-4.11.3.dist-info\license
- %TEMP%\_mei27922\importlib_metadata-4.11.3.dist-info\metadata
- %TEMP%\_mei27922\importlib_metadata-4.11.3.dist-info\record
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\medium-black\__base__
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\medium-black\pretty.css
- %TEMP%\_mei27922\docutils\writers\s5_html\themes\medium-white\framing.css
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\license.bsd
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\license.apache
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\license
- %TEMP%\_mei27922\crypto\hash\_sha224.pyd
- %TEMP%\_mei27922\crypto\hash\_sha256.pyd
- %TEMP%\_mei27922\crypto\hash\_sha384.pyd
- %TEMP%\_mei27922\crypto\hash\_sha512.pyd
- %TEMP%\_mei27922\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei27922\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei27922\crypto\hash\_keccak.pyd
- %TEMP%\_mei27922\crypto\hash\_poly1305.pyd
- %TEMP%\_mei27922\crypto\math\_modexp.pyd
- %TEMP%\_mei27922\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei27922\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei27922\vcruntime140.dll
- %TEMP%\_mei27922\crypto\hash\_md5.pyd
- %TEMP%\_mei27922\crypto\publickey\_x25519.pyd
- %TEMP%\_mei27922\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei27922\crypto\util\_strxor.pyd
- %TEMP%\_mei27922\msvcp140.dll
- %TEMP%\_mei27922\pil\_imaging.cp39-win_amd64.pyd
- %TEMP%\_mei27922\pil\_imagingft.cp39-win_amd64.pyd
- %TEMP%\_mei27922\pil\_imagingtk.cp39-win_amd64.pyd
- %TEMP%\_mei27922\pil\_webp.cp39-win_amd64.pyd
- %TEMP%\_mei27922\pil\msvcp140.dll
- %TEMP%\_mei27922\pil\vcruntime140_1.dll
- %TEMP%\_mei27922\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei27922\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei27922\crypto\publickey\_ed448.pyd
- %TEMP%\_mei27922\crypto\hash\_md2.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_cbc.pyd
- %WINDIR%\edge.exe
- %WINDIR%\client-built.exe
- %WINDIR%\registry.exe
- %TEMP%\_mei27922\crypto\cipher\_arc4.pyd
- %TEMP%\_mei27922\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei27922\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei27922\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei27922\crypto\hash\_md4.pyd
- %TEMP%\_mei27922\vcruntime140_1.dll
- %WINDIR%\regisstry.exe
- %TEMP%\_mei27922\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei27922\crypto\hash\_blake2b.pyd
- %TEMP%\_mei27922\crypto\hash\_blake2s.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei27922\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei27922\crypto\hash\_sha1.pyd
- %TEMP%\_mei27922\_asyncio.pyd
- %TEMP%\_mei27922\markupsafe\_speedups.cp39-win_amd64.pyd
- %TEMP%\_mei27922\multidict\_multidict.cp39-win_amd64.pyd
- %TEMP%\_mei27922\psutil\_psutil_windows.cp39-win_amd64.pyd
- %TEMP%\_mei27922\pyexpat.pyd
- %TEMP%\_mei27922\python3.dll
- %TEMP%\_mei27922\python39.dll
- %TEMP%\_mei27922\pythoncom39.dll
- %TEMP%\_mei27922\pywin32_system32\pywintypes39.dll
- %TEMP%\_mei27922\pywintypes39.dll
- %TEMP%\_mei27922\select.pyd
- %TEMP%\_mei27922\lz4\block\_block.cp39-win_amd64.pyd
- %TEMP%\_mei27922\libssl-1_1.dll
- %TEMP%\_mei27922\mfc140u.dll
- %TEMP%\_mei27922\simplejson\_speedups.cp39-win_amd64.pyd
- %TEMP%\_mei27922\win32com\shell\shell.pyd
- %TEMP%\_mei27922\win32cred.pyd
- %TEMP%\_mei27922\win32crypt.pyd
- %TEMP%\_mei27922\win32trace.pyd
- %TEMP%\_mei27922\win32ui.pyd
- %TEMP%\_mei27922\yarl\_quoting_c.cp39-win_amd64.pyd
- %TEMP%\_mei27922\base_library.zip
- %TEMP%\_mei27922\certifi\cacert.pem
- %TEMP%\_mei27922\cryptography-37.0.4.dist-info\installer
- %TEMP%\_mei27922\sqlite3.dll
- %TEMP%\_mei27922\unicodedata.pyd
- %TEMP%\_mei27922\win32api.pyd
- %TEMP%\_mei27922\lz4\_version.cp39-win_amd64.pyd
- %TEMP%\_mei27922\libffi-7.dll
- %TEMP%\_mei27922\_brotli.cp39-win_amd64.pyd
- %TEMP%\_mei27922\_cffi_backend.cp39-win_amd64.pyd
- %TEMP%\_mei27922\_ctypes.pyd
- %TEMP%\_mei27922\_decimal.pyd
- %TEMP%\_mei27922\_elementtree.pyd
- %TEMP%\_mei27922\_hashlib.pyd
- %TEMP%\_mei27922\_lzma.pyd
- %TEMP%\_mei27922\_msi.pyd
- %TEMP%\_mei27922\_multiprocessing.pyd
- %TEMP%\_mei27922\_overlapped.pyd
- %TEMP%\_mei27922\_pytransform.dll
- %TEMP%\_mei27922\_queue.pyd
- %TEMP%\_mei27922\_bz2.pyd
- %TEMP%\_mei27922\_socket.pyd
- %TEMP%\_mei27922\_ssl.pyd
- %TEMP%\_mei27922\_uuid.pyd
- %TEMP%\_mei27922\_win32sysloader.pyd
- %TEMP%\_mei27922\aiohttp\_frozenlist.cp39-win_amd64.pyd
- %TEMP%\_mei27922\aiohttp\_helpers.cp39-win_amd64.pyd
- %TEMP%\_mei27922\aiohttp\_http_parser.cp39-win_amd64.pyd
- %TEMP%\_mei27922\aiohttp\_http_writer.cp39-win_amd64.pyd
- %TEMP%\_mei27922\aiohttp\_websocket.cp39-win_amd64.pyd
- %TEMP%\_mei27922\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei27922\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei27922\libcrypto-1_1.dll
- %TEMP%\_mei27922\_sqlite3.pyd
- %TEMP%\_mei27922\wheel-0.37.1.dist-info\top_level.txt
- %WINDIR%\syswow64\system\secure system.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\system\secure system.exe
Network activity
Connects to
- 'ip##pi.com':80
- 'al#####wo.at.playit.gg':61401
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
- DNS ASK al#####wo.at.playit.gg
Miscellaneous
Creates and executes the following
- '%WINDIR%\sop tokengen.exe'
- '%WINDIR%\edge.exe'
- '%WINDIR%\regisstry.exe'
- '%WINDIR%\client-built.exe'
- '%WINDIR%\registry.exe'
- '%WINDIR%\syswow64\system\secure system.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGsAeQB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAcwBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%WINDIR%\sop tokengen.exe' ' (with hidden window)
- '%WINDIR%\edge.exe' ' (with hidden window)
- '%WINDIR%\regisstry.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHAAagBrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGsAZABqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHgAcQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAaQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%WINDIR%\client-built.exe' ' (with hidden window)
- '%WINDIR%\registry.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "WINDOWSSYSTEMHOST" /tr "%WINDIR%\SysWOW64\System\Secure System.exe" /sc MINUTE /MO 1' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGsAeQB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAcwBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHAAagBrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGsAZABqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHgAcQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAaQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\schtasks.exe' /create /tn "Update" /sc ONLOGON /tr "%WINDIR%\Client-built.exe" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Update" /sc ONLOGON /tr "%WINDIR%\SysWOW64\System\Secure System.exe" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WINDOWSSYSTEMHOST" /tr "%WINDIR%\SysWOW64\System\Secure System.exe" /sc MINUTE /MO 1
- '<SYSTEM32>\taskeng.exe' {9EF027EC-898A-403A-B8E7-85B5736B3D36} S-1-5-21-1960123792-2022915161-3775307078-1001:vwbjpi\user:Interactive:[1]
