Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windowsupdate_dropper
- <SYSTEM32>\tasks\microsoft\windows\windowsupdate_ps
Modifies file system
Creates the following files
- %APPDATA%\windowsupdate.ps1
Network activity
UDP
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -File "%APPDATA%\WindowsUpdate.ps1"
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft\Windows\WindowsUpdate_Dropper" /tr "\"<Full path to file>\"" /sc onlogon /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft\Windows\WindowsUpdate_PS" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"%APPDATA%\WindowsUpdate.ps1\"" /sc hourly /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft\Windows\WindowsUpdate_Dropper" /tr "\"<Full path to file>\"" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft\Windows\WindowsUpdate_PS" /tr "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"%APPDATA%\WindowsUpdate.ps1\"" /sc hourly /f' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -File "%APPDATA%\WindowsUpdate.ps1"' (with hidden window)
