Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\startmonitor
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\winver.exe
- <SYSTEM32>\computerdefaults.exe
- <SYSTEM32>\securityhealthservice.exe
- <SYSTEM32>\securityhealthsystray.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\golden\run_55045585.exe
- %TEMP%\~dump.tmp
- %ALLUSERSPROFILE%\microsoft\windows security health\logs\shs-01192026-182621-7-7f-19041.1.amd64fre.vb_release.191206-1406.etl
Network activity
Connects to
- '<DNS_SERVER>':53
- '10#.#01.176.131':21501
UDP
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\golden\run_55045585.exe' -bypass
Executes the following
- '%WINDIR%\explorer.exe' shell:::{1D158548-6368-492D-94DF-DD928B398CBD}
- '<SYSTEM32>\winver.exe'
- '<SYSTEM32>\cmd.exe' /c "gpupdate /force"
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\securityhealthservice.exe'
- '%WINDIR%\explorer.exe' shell:::{1D158548-6368-492D-94DF-DD928B398CBD}' (with hidden window)
- '%ALLUSERSPROFILE%\golden\run_55045585.exe' -bypass' (with hidden window)
- '<SYSTEM32>\winver.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "gpupdate /force"' (with hidden window)
