Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%APPDATA%\WindowsControl\WindowsControl.exe,'
Creates or modifies the following files
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\windowscontrolw
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\taskhostw.exe
- <SYSTEM32>\runtimebroker.exe
- %WINDIR%\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\sppextcomobj.exe
- %WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
- <SYSTEM32>\wbem\wmiprvse.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\fontdrvhost.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\slui.exe
- <SYSTEM32>\schtasks.exe
the following user processes:
- firefox.exe
- iexplore.exe
Hooks functions
in browsers
- iexplore.exe process, advapi32.dll module
- firefox.exe process, advapi32.dll module
Patches code
in dll
- unwx.exe process, KERNEL32.dll module
- unwx.exe process, KERNELBASE.dll module
- runtimebroker.exe process, ADVAPI32.dll module
- lsass.exe process, win32u.dll module
- cmd.exe process, SECHOST.dll module
- cmd.exe process, ADVAPI32.dll module
- cmd.exe process, win32u.dll module
- windowscontrol.exe process, KERNEL32.dll module
- windowscontrol.exe process, KERNELBASE.dll module
- schtasks.exe process, SECHOST.dll module
- schtasks.exe process, ADVAPI32.dll module
- schtasks.exe process, win32u.dll module
- slui.exe process, SECHOST.dll module
- slui.exe process, ADVAPI32.dll module
- slui.exe process, win32u.dll module
in AMSI dll
- unwx.exe process, Amsi.dll module
- windowscontrol.exe process, Amsi.dll module
in NTDLL dll
- unwx.exe process, ntdll.dll module
- cmd.exe process, ntdll.dll module
- windowscontrol.exe process, ntdll.dll module
- schtasks.exe process, ntdll.dll module
- slui.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\content\4204-4212-<File name>.exe-01-08-27-628.dump
- %APPDATA%\windowscontrol\windowscontrol.exe
- %TEMP%\$77temp\a03b8207-2e1a-465e-bb1a-bef46ea86693.dll
- %TEMP%\$77temp\8a4adcd3-8d4c-4ff0-a437-e1c79bf89d3f.dll
- %TEMP%\$77temp\1574b2b8-de0a-42c9-a1cc-b88aaef4f17f.dll
- %TEMP%\$77temp\ae4d789d-e010-4105-a578-03714fab2cba.dll
- %TEMP%\$77temp\9f9a99d2-bdff-4e02-b77a-f94a01923218.dll
- %TEMP%\$77temp\67ba3716-e8b9-406e-bbcc-e34ada692f97.dll
- %TEMP%\$77temp\44a135b1-0fbe-477d-b083-004d9e45aaab.dll
- %TEMP%\$77temp\7bec2ea4-a6ee-49e0-9d65-ffccb4799832.dll
- %TEMP%\$77temp\4de7dd20-6172-4b44-aa87-50625a3112e7.dll
- %TEMP%\$77temp\aea3a328-161f-485c-95c5-20cafb999809.dll
- %TEMP%\$77temp\ce8d5a43-6b46-4dbf-a46b-230917afc9f7.dll
- %TEMP%\$77temp\7e157c08-fcc6-43f7-ad11-813c76830fd0.dll
- %TEMP%\$77temp\df07e243-ee7c-4db7-90e6-263897e7faa0.dll
- %TEMP%\$77temp\25b053ca-1b95-4df4-9613-5596ddac8f6b.dll
- %TEMP%\$77temp\255f576f-2445-4d4a-9e87-088c85898527.dll
- %TEMP%\$77temp\3e47f56f-29ce-4dd3-b8bb-a28d76a3e598.dll
- %TEMP%\$77temp\ebda8ba7-9b70-4e7b-8f5b-32a6f72362a9.dll
- %TEMP%\$77temp\e9db73e9-43a1-4f89-9084-6f3d8a25861f.dll
- %TEMP%\$77temp\5d630a4f-edfa-455f-81b4-da3d179aa1a9.dll
- %TEMP%\$77temp\40116276-266e-4e50-97e8-4840497f56fa.dll
- %TEMP%\$77temp\54001a6c-68cf-475c-a221-07d5f2070e2b.dll
- %TEMP%\$77temp\5c6219f2-fd2a-4e05-88fd-fb9674926cc3.dll
- %TEMP%\$77temp\4236d20b-ada3-402b-988c-09edfaf9cf70.dll
- %TEMP%\$77temp\0f29dd4f-a7b4-4c95-9685-0f9cce8fe119.dll
- %TEMP%\$77temp\0986ed36-c134-47df-b962-6bc0dc114dbd.dll
- %TEMP%\$77temp\c51b163a-356a-4211-9399-15c049607ccb.dll
- %TEMP%\$77temp\b490dd00-42e7-46a3-8ac2-c22d96ac305f.dll
- %TEMP%\$77temp\4cfcb39d-c3ce-4151-977f-f14c778cc8b3.dll
- %TEMP%\$77temp\4c0179c3-c14b-4ae2-88c8-c837c2baa8ed.dll
- %TEMP%\$77temp\7ae0c55f-6db0-4168-b89b-4fac5e8995ee.dll
- %TEMP%\$77temp\1a02ca82-aa59-4bfd-acec-b42941cd8ad3.dll
- %TEMP%\$77temp\46380f35-42d8-4140-a7f9-59e614285048.dll
- %TEMP%\$77temp\363567e5-f0b1-4e29-aa1a-9bba20501682.dll
- %TEMP%\$77temp\4821f806-7b0c-4110-a5dd-8156c4a3e624.dll
- %TEMP%\$77temp\42b277d7-5ba1-4492-8c3e-d8a23f8ec5d4.dll
- %TEMP%\$77temp\7d2d14fc-f606-4597-b29b-9004f679cdb3.dll
- %TEMP%\$77temp\61bce560-e635-4ce2-9efe-b7147c9ecbcc.dll
- %TEMP%\$77temp\77821876-cd42-4a49-8ae0-526f364082b5.dll
- %TEMP%\$77temp\fd9aaf83-a1d7-49ab-b9ce-c8672a37a011.dll
- %TEMP%\$77temp\22a55e40-c740-4ec6-8e92-7d891fcf9b7b.dll
- %TEMP%\$77temp\99fa5835-90ab-4dd3-b354-864716a2c777.dll
- %TEMP%\$77temp\144da472-c21c-4b6b-b442-582e1f2e324a.dll
- %TEMP%\$77temp\4fd3681b-a275-40b7-92ff-7426d436da69.dll
- %TEMP%\$77temp\56601082-3a5c-4ee5-a857-a9c177e0da64.dll
- %TEMP%\$77temp\8cbee3ce-5e72-48a3-8b76-eb2eb11dc420.dll
- %TEMP%\$77temp\9e808564-bd65-4450-bf8f-d7002bfc848e.dll
- %TEMP%\$77temp\037f6947-c28f-413a-8410-99434cccd9ee.dll
- %TEMP%\$77temp\d53a7eba-7a93-4883-8e00-5b6da4c8792e.dll
- %TEMP%\$77temp\45ca9481-9af6-4092-8d96-666d450b702d.dll
- %TEMP%\$77temp\85e784e8-efec-4b82-b754-8c5947069879.dll
- %TEMP%\$77temp\1b8ca56e-20e3-40c4-83f2-61e134ceee46.dll
- %TEMP%\$77temp\04271c48-98c0-48de-bc3d-805dbfd2a0ae.dll
- %TEMP%\$77temp\eda56834-c51f-4006-bccd-d4885512a112.dll
- %TEMP%\$77temp\8056e01e-74d5-49a5-9472-b54f31262dc6.dll
- %TEMP%\$77temp\a3cf6777-ec3f-46f5-8cf3-243c84a25cda.dll
- %TEMP%\$77temp\83bcb109-12fe-465f-9167-666d9dde26bf.dll
- %TEMP%\$77temp\aa6422e8-9453-48c3-879e-7b774f1886d6.dll
- %TEMP%\$77temp\1b8a0322-d870-4578-86a9-a826f7283669.dll
- %TEMP%\$77temp\f217576b-5454-495b-8d9a-853ebed1c515.dll
- %TEMP%\$77temp\eef5fbf7-43a3-4c33-b920-6872f3e8d306.dll
- %TEMP%\$77temp\82a33307-526e-4bed-b2f0-10c8d302c7dc.dll
- %TEMP%\$77temp\c56ac4c4-85da-4d0b-857d-bd00405deb1a.dll
- %TEMP%\$77temp\b7404bc3-86b1-4e98-935d-d6f3474eb600.dll
- %TEMP%\$77temp\ea5b6fa3-efdd-4119-82f5-3a346c7e326d.dll
- %APPDATA%\windowscontrol\windowscontrolw.exe
- %TEMP%\$77temp\e8111d4a-8aa0-4e68-b50d-85124adba897.dll
- %TEMP%\$77temp\f4d56597-203a-4f48-bca5-799f9443c44c.dll
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\content\1260-3744-windowscontrol.exe-01-08-53-943.dump
- %TEMP%\$77temp\f0bfe56c-909e-45e3-8c9e-b8cf8b64ce15.dll
- %TEMP%\$77temp\dedf27fa-763f-4b21-9667-217b8f3294e5.dll
- %TEMP%\$77temp\5db506ba-a245-4d59-9444-544d8d44e4d5.dll
- %TEMP%\$77temp\10b994c1-4223-4c57-b5c1-b5d89235513d.dll
- %TEMP%\$77temp\4b13f73e-9d8f-4032-bc75-03e5642b384b.dll
- %TEMP%\$77temp\02d98d0f-34eb-4ace-9ec4-cb8a2d292d84.dll
- %TEMP%\$77temp\0d238960-8777-4eff-9fe5-a7ffdc9bff52.dll
- %TEMP%\$77temp\74c88032-b16e-436e-8118-c20a059571b1.dll
- %TEMP%\$77temp\efc8b190-9de6-4e57-b4da-b3f9c9ce97e8.dll
- %TEMP%\$77temp\ea4c2098-0abc-4f7b-bea5-af0cdb332a47.dll
- %TEMP%\$77temp\8b0fc923-df93-4e59-995b-e11842720960.dll
- %TEMP%\$77temp\830d448e-9042-43d3-b291-279601c02c38.dll
- %TEMP%\$77temp\30ae1113-ef7d-4710-8661-b2aafdc78dd2.dll
- %TEMP%\$77temp\99fac35a-5436-4576-94e3-57e3ece75556.dll
- %TEMP%\$77temp\a4ecf710-1ac6-4649-8deb-0cebc843c8fd.dll
- %TEMP%\$77temp\01570806-6948-4c74-9bc6-1a4725b5bff2.dll
- %TEMP%\$77temp\eb387c88-24aa-4876-99d1-5e58388a35ae.dll
- %TEMP%\$77temp\b9909328-c0b4-4e65-9449-a3a3ddcbdad8.dll
- %TEMP%\$77temp\aa67554b-bafc-4d05-9225-2bd8dc70b192.dll
- %TEMP%\$77temp\4205a3dd-19e6-48c2-bca4-a412cf49d865.dll
- %TEMP%\$77temp\14b6dbe3-7420-4bbe-bf12-1ea2ad5cf415.dll
- %TEMP%\$77temp\d40615eb-4689-4ca0-a503-45557205168d.dll
- %TEMP%\$77temp\153f9e61-5806-45c2-8fc2-5d053d3edb0c.dll
- %TEMP%\$77temp\4c912f5f-27f2-4c57-b53e-617ac4296113.dll
- %TEMP%\$77temp\65aa4730-4960-4ea3-b55f-5943665b053b.dll
- %TEMP%\$77temp\a4e7f744-87fd-49e4-8d2b-2163b9d7a905.dll
- %TEMP%\$77temp\4a9cfe6c-5d24-4ad1-ada7-88500ae8f669.dll
- %TEMP%\$77temp\fb8acaf5-2ed8-40d9-a69a-2c1ed0098f78.dll
- %TEMP%\$77temp\f9f8fcd9-a0c1-4ae1-b0de-9ff70e160ecf.dll
- %TEMP%\$77temp\548bb2ef-c64b-48d7-9921-0420baddfe76.dll
- %TEMP%\$77temp\0eb22378-43f6-4be4-af4c-ed065af981f3.dll
- %TEMP%\$77temp\5c0d854f-ec79-43a8-b606-51a2b3c8c5bb.dll
- %TEMP%\$77temp\be16cfd8-4315-40fe-81f8-96b9e3c1c804.dll
- %TEMP%\$77temp\99bad645-7b56-4d22-b0aa-ca1ce40d08d3.dll
- %TEMP%\$77temp\39c4d2e6-e810-4a24-805f-d66ed8b6d20a.dll
- %TEMP%\$77temp\acbf61c8-dd4f-41da-a4f6-ee59310fc76b.dll
- %TEMP%\$77temp\c47cf6f8-3b95-42b0-94cd-f498829445ee.dll
- %TEMP%\$77temp\79462d8e-8ba6-48d5-8093-2b6c02bbd30d.dll
- %TEMP%\$77temp\039d1cda-6f41-4b01-b417-4a1bbc3696bb.dll
- %TEMP%\$77temp\03434d4f-af0f-4fcc-bdfb-6a5b9752495a.dll
- %TEMP%\$77temp\1d9d3fbe-1403-4bbf-a0d8-aa414b0486d8.dll
- %TEMP%\$77temp\fa0ab89b-04c8-4ea4-9f78-a3ba6b326937.dll
- %TEMP%\$77temp\b01081eb-6c47-4d9b-86d6-4db241375543.dll
- %TEMP%\$77temp\1eca7276-f1fe-4e97-bbc5-7668ef85d654.dll
- %TEMP%\$77temp\f0602a1a-ec98-4cbb-85ee-d7318d99f861.dll
- %TEMP%\$77temp\9bee0629-5b58-43c4-ac50-cee5524820a4.dll
- %TEMP%\$77temp\1bb2cbc9-d43d-4895-9b67-9be5f31760ba.dll
- %TEMP%\$77temp\3da45d9b-8f33-4027-b974-181942dca79a.dll
- %TEMP%\$77temp\f31f932c-6905-495e-aa91-438a445c04bb.dll
- %TEMP%\$77temp\6d6b5511-40b3-41a4-8a0a-0c23e57f814e.dll
- %TEMP%\$77temp\3f3b063b-4ec8-4c08-b279-26e1898a8bbd.dll
- %TEMP%\$77temp\2a3fc64d-4b6c-43a7-95eb-0add51ae1391.dll
- %TEMP%\$77temp\84f1eaa2-f090-459d-9bcd-efd8d6c55ac3.dll
- %TEMP%\$77temp\2a3904f5-ed02-4a08-a5e4-13c76ddd093f.dll
- %TEMP%\$77temp\a8eab966-2fab-4b19-b4f4-334af7198852.dll
- %TEMP%\$77temp\28021e6a-2a03-4c49-89e8-466ba22356de.dll
- %TEMP%\$77temp\955b1bf7-dd49-482f-850a-678d4ca1158a.dll
- %TEMP%\$77temp\7cff4b79-24ce-4aa9-afbf-8d6e6d44d24e.dll
- %TEMP%\$77temp\7a84b3dc-933b-44ff-9a80-0475f8b51cfd.dll
- %TEMP%\$77temp\57fe7670-72cd-4efa-b7f8-742de5e67969.dll
- %TEMP%\$77temp\835a702c-c24d-4450-b2ca-66b22f18ee18.dll
- %TEMP%\$77temp\c1efabe2-3127-4137-810a-67fb6cba9358.dll
- %TEMP%\$77temp\83ffbbf0-73b2-4299-be92-3e5940093878.dll
- %TEMP%\$77temp\03d94d7b-c9b0-40ee-9896-aa4e4093590f.dll
- %TEMP%\$77temp\45d4ad96-a662-4270-8fa9-b9b7a3367f19.dll
- %TEMP%\$77temp\99217406-e0cd-4799-a183-bb01f8538662.dll
- %TEMP%\$77temp\b77d1487-4d8c-4e40-a9a4-6f107693e16f.dll
- %TEMP%\$77temp\cc545e9c-2db1-4afa-a495-1d65427c5306.dll
- %TEMP%\$77temp\c5d110e5-0efc-4d85-88e9-0f491365f22a.dll
- %TEMP%\$77temp\76fdbdcf-7ad1-4dff-a8eb-26cf6d66a9ed.dll
Deletes following files that it created itself
- <SYSTEM32>\tasks\svchost
Network activity
Connects to
- '94.##6.179.152':8989
UDP
- DNS ASK ip##pi.com
- DNS ASK fi#####.###tings.services.mozilla.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\windowscontrol\windowscontrol.exe'
Executes the following
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' config WinDefend start= demand
- '<SYSTEM32>\cmd.exe' netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="%APPDATA%\WindowsControl\WindowsControl.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /F /TN "svchost" & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /tn "svchost" /tr "%APPDATA%\WindowsControl\WindowsControl.exe" & exit
- '<SYSTEM32>\schtasks.exe' /delete /F /TN "svchost"
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /tn "svchost" /tr "%APPDATA%\WindowsControl\WindowsControl.exe"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "%APPDATA%\WindowsControl\WindowsControlW.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "%APPDATA%\WindowsControl\WindowsControlW.exe" /RL HIGHEST
