Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Microsoft\Windows\systemtask.exe"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Microsoft\windows\systemtask.exe"
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\windrv.msi
- %TEMP%\mw-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\msiwrapper.ini
- %TEMP%\mw-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\files.cab
- %TEMP%\mw-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\files\$dpx$.tmp\bfb3f7e5e23ae046a892c5b86b2856eb.tmp
- %TEMP%\x21s.1-shm
- %TEMP%\x21s.2-shm
Moves the following files
- from %TEMP%\mw-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\files\$dpx$.tmp\bfb3f7e5e23ae046a892c5b86b2856eb.tmp to %TEMP%\mw-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\files\setup.exe
Network activity
Connects to
- 'cs#####ewmwwaaui.xyz':443
- 'cy#####iamiscyia.xyz':443
- 'ok#####emoucqeso.xyz':443
- 'ik#####kiqeimwua.xyz':443
- 'aa#####aywckiwmi.xyz':443
- 'qg#####sgaeyuqqe.xyz':443
- 'ei#####amyqqgcea.xyz':443
- 'yw#####kicsqomqw.xyz':443
TCP
HTTP GET requests
- http://cs######wmwwaaui.xyz:443/api/client_hello via cs#####ewmwwaaui.xyz
- http://cy######amiscyia.xyz:443/api/client_hello via cy#####iamiscyia.xyz
- http://ok######moucqeso.xyz:443/api/client_hello via ok#####emoucqeso.xyz
- http://ik######iqeimwua.xyz:443/api/client_hello via ik#####kiqeimwua.xyz
- http://aa######ywckiwmi.xyz:443/api/client_hello via aa#####aywckiwmi.xyz
- http://yw######icsqomqw.xyz:443/api/client_hello via yw#####kicsqomqw.xyz
UDP
- DNS ASK ki#####msiieeyqa.xyz
- DNS ASK ss#####uowqcwsqo.xyz
- DNS ASK yk#####uummieaug.xyz
- DNS ASK ew#####gqswqesiw.xyz
- DNS ASK cs#####ewmwwaaui.xyz
- DNS ASK cy#####iamiscyia.xyz
- DNS ASK ok#####emoucqeso.xyz
- DNS ASK ik#####kiqeimwua.xyz
- DNS ASK aa#####aywckiwmi.xyz
- DNS ASK ai#####gmyeqocei.xyz
- DNS ASK qg#####sgaeyuqqe.xyz
- DNS ASK ei#####amyqqgcea.xyz
- DNS ASK yw#####kicsqomqw.xyz
Miscellaneous
Creates and executes the following
- '%TEMP%\mw-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\files\setup.exe' /VERYSILENT /VERYSILENT
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "%TEMP%\MW-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH' (with hidden window)
Executes the following
- '<SYSTEM32>\msiexec.exe' /i "%LOCALAPPDATA%\Microsoft\Windows\windrv.msi" /Qn
- '%WINDIR%\syswow64\icacls.exe' "%TEMP%\MW-71788ecd-8426-40d9-9af0-7f4d8fa5ae6a\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files
- '%WINDIR%\syswow64\systeminfo.exe'
