Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\Software\Classes\.wm7e\Shell\open\command] '' = '%ProgramFiles%\WW2017CF\wmcEncryption7.exe %1 decrypt'
- [<HKLM>\Software\Classes\.wsef\Shell\open\command] '' = '%ProgramFiles%\WW2017CF\wmcEncryption7.exe %1 decrypt'
- [<HKLM>\Software\Classes\.jm7e\Shell\open\command] '' = '%ProgramFiles%\WW2017CF\wmcEncryption7.exe %1 decrypt'
- [<HKLM>\Software\Classes\.jsef\Shell\open\command] '' = '%ProgramFiles%\WW2017CF\wmcEncryption7.exe %1 decrypt'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WM7F] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WM7F] 'ImagePath' = 'system32\DRIVERS\WM7F.sys'
- [<HKLM>\System\CurrentControlSet\Services\Win-Win7] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Win-Win7] 'ImagePath' = '"%ProgramFiles%\WW2017CF\wmcSystem7.exe"'
- [<HKLM>\System\CurrentControlSet\Services\cbregistry20] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\cbregistry20] 'ImagePath' = 'system32\drivers\cbregistry20.sys'
Creates the following services
- 'WM7F' system32\DRIVERS\WM7F.sys
- 'Win-Win7' "%ProgramFiles%\WW2017CF\wmcSystem7.exe"
- 'Win-Win7' %ProgramFiles%\WW2017CF\wmcSystem7.exe
- 'cbregistry20' system32\drivers\cbregistry20.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\System\Currentcontrolset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\System\Currentcontrolset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
To complicate detection of its presence in the operating system,
modifies the following system settings:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoControlPanel' = '00000000'
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WinMaster Client7" dir=in program="%ProgramFiles%\ww2017cf\wmcSystem7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfac...
Registers file system filter
- [<HKLM>\System\CurrentControlSet\Services\WM7F] 'Group' = 'FSFilter Activity Monitor'
Modifies file system
Creates the following files
- C:\users\public\smr7\debug\manualupdate\2022_06_20_tcnkolq.log
- %ProgramFiles%\ww2017cf\wm7f.inf.w7_x64_signed
- %WINDIR%\debug\wm7\client\wmcsystem7.exe\20220620.log
- %ProgramFiles%\ww2017cf\tgt4.ini
- C:\users\public\securityedit.txt
- %TEMP%\sce30001.tmp
- C:\users\public\systemaudit.txt
- C:\users\public\smr7\debug\winwin7.regdebug.log
- %TEMP%\regf4c9.tmp
- %WINDIR%\debug\wm7\updaterlog\20220620.log
- %WINDIR%\debug\wm7\warninglog\cce\20220620.log
- %WINDIR%\syswow64\winnetdaily.dll
- %WINDIR%\syswow64\pcinfo7.exe
- <SYSTEM32>\winnetdaily.dll
- <SYSTEM32>\pcinfo7.exe
- %ProgramFiles%\ww2017cf\wmcwatermark_dll64.dll
- <DRIVERS>\wm7f.inf
- %ProgramFiles%\ww2017cf\wmcwatermark_dll.dll
- %ProgramFiles%\ww2017cf\wmcwatermark764.exe
- %ProgramFiles%\ww2017cf\wmcwatermark7.exe
- %ProgramFiles%\ww2017cf\wmcuser7.exe
- %ProgramFiles%\ww2017cf\wmcupdater.exe
- %ProgramFiles%\ww2017cf\wmcsystem7.exe
- %ProgramFiles%\ww2017cf\wmcservice7.exe
- %ProgramFiles%\ww2017cf\wmcrms7.exe
- %ProgramFiles%\ww2017cf\wmcrcslave7.exe
- %ProgramFiles%\ww2017cf\wmcproc7.exe
- %ProgramFiles%\ww2017cf\wmcmemmgr64.dll
- %ProgramFiles%\ww2017cf\wmcmemmgr.dll
- %ProgramFiles%\ww2017cf\wmchook764.dll
- %ProgramFiles%\ww2017cf\xceedcry.dll
- %ProgramFiles%\ww2017cf\cbregistry.cab
- <DRIVERS>\wm7f.sys
- <DRIVERS>\cbregistry20.sys
- %WINDIR%\inf\oem1.pnf
- %WINDIR%\inf\oem0.pnf
- <SYSTEM32>\cbregistryevtmsg.dll
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\arm64\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\x64\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\x64\sha1\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\i386\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\i386\sha1\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\cbregistryevtmsg.dll
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\cbregist.cab
- %ProgramFiles%\ww2017cf\info\bootinfo.opt
- %WINDIR%\debug\wm7\client\wmcuser7.exe\20220620.log
- %ProgramFiles%\ww2017cf\info\machineswinfo.opt
- %ProgramFiles%\ww2017cf\wmchook7.dll
- %ProgramFiles%\ww2017cf\wm7f.sys.w7_x64_signed
- %ProgramFiles%\ww2017cf\smrpolicy.txt
- %ProgramFiles%\ww2017cf\policy\system\policycontainer.tmp
- %ProgramFiles%\ww2017cf\policy\system\policycontainer.bak
- %ProgramFiles%\ww2017cf\info\aduserinfo.txt
- %ProgramFiles%\ww2017cf\info\logoninfo.opt
- %ProgramFiles%\ww2017cf\info\pcinfo.opt
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\fc1e3851f429ea606d6ff1e01a5229f1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %WINDIR%\temp\udd4dc6.tmp
- %WINDIR%\temp\udd453d.tmp
- %WINDIR%\temp\udd3a16.tmp
- %WINDIR%\temp\udd28d6.tmp
- %WINDIR%\temp\udd1e0c.tmp
- %WINDIR%\temp\udd1573.tmp
- <DRIVERS>\seteaf.tmp
- %ProgramFiles%\ww2017cf\policy\log\2022_06_20.log
- %WINDIR%\temp\olde81.tmp
- %ProgramFiles%\ww2017cf\wmcftslave7.exe
- %ProgramFiles%\ww2017cf\wmcenterprise.dat
- %ProgramFiles%\ww2017cf\wmcencryption7.exe
- C:\users\public\smr7\wm7installtemp\version.dat
- C:\users\public\smr7\wm7installtemp\wmcrms7.exe
- C:\users\public\smr7\wm7installtemp\wmcrcslave7.exe
- C:\users\public\smr7\wm7installtemp\wmcproc7.exe
- C:\users\public\smr7\wm7installtemp\wmcmemmgr64.dll
- C:\users\public\smr7\wm7installtemp\wmcmemmgr.dll
- C:\users\public\smr7\wm7installtemp\wmchook764.dll
- C:\users\public\smr7\wm7installtemp\wmchook7.dll
- C:\users\public\smr7\wm7installtemp\wmcftslave7.exe
- C:\users\public\smr7\wm7installtemp\wmcenterprise.dat
- C:\users\public\smr7\wm7installtemp\wmcencryption7.exe
- C:\users\public\smr7\wm7installtemp\wmcdataburner7.exe
- C:\users\public\smr7\wm7installtemp\wm7f.cab
- C:\users\public\smr7\wm7installtemp\winnetdaily.dll
- %WINDIR%\temp\uddf913.tmp
- C:\users\public\smr7\wm7installtemp\wmcservice764.exe
- C:\users\public\smr7\wm7installtemp\tgt2.ini
- C:\users\public\smr7\wm7installtemp\serverschtask.dat
- C:\users\public\smr7\wm7installtemp\scheduletask.exe
- C:\users\public\smr7\wm7installtemp\policyviewer40.exe
- C:\users\public\smr7\wm7installtemp\policyviewer20.exe
- C:\users\public\smr7\wm7installtemp\pcinfo7.exe
- C:\users\public\smr7\wm7installtemp\gcbsettings.exe
- C:\users\public\smr7\wm7installtemp\gcbclient.exe
- C:\users\public\smr7\wm7installtemp\foxsdku32w.dll
- C:\users\public\smr7\wm7installtemp\cbregistry.cab
- C:\users\public\smr7\wm7installtemp\cbfsfilter2064.dll
- C:\users\public\smr7\wm7installtemp\cbfsfilter20.dll
- C:\users\public\smr7\wm7clientpackage.cab
- C:\users\public\smr7\manualupdate.ini
- C:\users\public\smr7\wm7installtemp\winet.lnk
- %ProgramFiles%\ww2017cf\info\user.opt
- C:\users\public\smr7\wm7installtemp\wmcsystem7.exe
- C:\users\public\smr7\wm7installtemp\wmcsystem764.exe.xp
- C:\users\public\smr7\wm7installtemp\wmcsystem7.exe.xp
- %ProgramFiles%\ww2017cf\wmcdataburner7.exe
- %ProgramFiles%\ww2017cf\wm7f.cab
- %ProgramFiles%\ww2017cf\winnetdaily.dll
- %ProgramFiles%\ww2017cf\winet.lnk
- %ProgramFiles%\ww2017cf\version.dat
- %ProgramFiles%\ww2017cf\tgt2.ini
- %ProgramFiles%\ww2017cf\serverschtask.dat
- %ProgramFiles%\ww2017cf\scheduletask.exe
- %ProgramFiles%\ww2017cf\policyviewer.exe
- %ProgramFiles%\ww2017cf\policy\system\policycontainer.opt
- %ProgramFiles%\ww2017cf\pcinfo7.exe
- %ProgramFiles%\ww2017cf\info\remoteservice.opt
- %ProgramFiles%\ww2017cf\gcbsettings.exe
- C:\users\public\smr7\wm7installtemp\wmcsystem764.exe
- %ProgramFiles%\ww2017cf\gcbclient.exe
- C:\users\public\smr7\wm7installtemp\wmcservice7.exe
- %ProgramFiles%\ww2017cf\cbfsfilter2032.dll
- %ProgramFiles%\ww2017cf\cbfsfilter20.dll
- C:\users\public\smr7\wm7installtemp\policyviewer.exe
- C:\users\public\smr7\wm7installtemp\cbfsfilter2032.dll
- C:\users\public\smr7\wm7installtemp\info\remoteservice.opt
- C:\users\public\smr7\wm7installtemp\policy\system\policycontainer.opt
- C:\users\public\smr7\wm7installtemp\xceedcry.dll
- C:\users\public\smr7\wm7installtemp\wmcwatermark_dll64.dll
- C:\users\public\smr7\wm7installtemp\wmcwatermark_dll.dll
- C:\users\public\smr7\wm7installtemp\wmcwatermark764.exe
- C:\users\public\smr7\wm7installtemp\wmcwatermark7.exe
- C:\users\public\smr7\wm7installtemp\wmcuser7.exe
- C:\users\public\smr7\wm7installtemp\wmcupdater.exe
- %ProgramFiles%\ww2017cf\foxsdku32w.dll
- %WINDIR%\debug\smr7\scheduletask\2022_06_20.log
Deletes the following files
- C:\users\public\smr7\manualupdate.ini
- C:\users\public\smr7\wm7installtemp\info\remoteservice.opt
- C:\users\public\smr7\wm7installtemp\pcinfo7.exe
- C:\users\public\smr7\wm7installtemp\policy\system\policycontainer.opt
- C:\users\public\smr7\wm7installtemp\policyviewer.exe
- C:\users\public\smr7\wm7installtemp\scheduletask.exe
- C:\users\public\smr7\wm7installtemp\serverschtask.dat
- C:\users\public\smr7\wm7installtemp\tgt2.ini
- C:\users\public\smr7\wm7installtemp\version.dat
- C:\users\public\smr7\wm7installtemp\winet.lnk
- C:\users\public\smr7\wm7installtemp\winnetdaily.dll
- C:\users\public\smr7\wm7installtemp\wm7f.cab
- C:\users\public\smr7\wm7installtemp\wmcdataburner7.exe
- C:\users\public\smr7\wm7installtemp\wmcencryption7.exe
- C:\users\public\smr7\wm7installtemp\wmcenterprise.dat
- C:\users\public\smr7\wm7installtemp\wmchook7.dll
- C:\users\public\smr7\wm7installtemp\xceedcry.dll
- C:\users\public\smr7\wm7installtemp\wmchook764.dll
- C:\users\public\smr7\wm7installtemp\wmcmemmgr.dll
- C:\users\public\smr7\wm7installtemp\wmcmemmgr64.dll
- C:\users\public\smr7\wm7installtemp\wmcproc7.exe
- C:\users\public\smr7\wm7installtemp\wmcrcslave7.exe
- C:\users\public\smr7\wm7installtemp\wmcrms7.exe
- C:\users\public\smr7\wm7installtemp\wmcservice7.exe
- C:\users\public\smr7\wm7installtemp\wmcsystem7.exe
- C:\users\public\smr7\wm7installtemp\wmcupdater.exe
- C:\users\public\smr7\wm7installtemp\wmcuser7.exe
- C:\users\public\smr7\wm7installtemp\wmcwatermark7.exe
- C:\users\public\smr7\wm7installtemp\wmcwatermark764.exe
- C:\users\public\smr7\wm7installtemp\wmcwatermark_dll.dll
- C:\users\public\smr7\wm7installtemp\wmcwatermark_dll64.dll
- C:\users\public\smr7\wm7installtemp\gcbsettings.exe
- C:\users\public\smr7\wm7installtemp\wmcftslave7.exe
- C:\users\public\smr7\wm7installtemp\gcbclient.exe
- %WINDIR%\temp\udd28d6.tmp
- C:\users\public\smr7\wm7installtemp\wmcsystem764.exe
- C:\users\public\smr7\wm7installtemp\wmcservice764.exe
- C:\users\public\smr7\wm7installtemp\cbfsfilter2064.dll
- C:\users\public\smr7\wm7installtemp\wmcsystem764.exe.xp
- C:\users\public\smr7\wm7installtemp\wmcsystem7.exe.xp
- C:\users\public\smr7\wm7installtemp\policyviewer40.exe
- C:\users\public\smr7\wm7installtemp\policyviewer20.exe
- %ProgramFiles%\ww2017cf\wmcrms7.exe
- %TEMP%\regf4c9.tmp
- %TEMP%\sce30001.tmp
- %ProgramFiles%\ww2017cf\winet.lnk
- %WINDIR%\temp\olde81.tmp
- %WINDIR%\temp\udd1573.tmp
- %WINDIR%\temp\udd1e0c.tmp
- %WINDIR%\temp\udd3a16.tmp
- C:\users\public\smr7\wm7installtemp\cbregistry.cab
- %ProgramFiles%\ww2017cf\wm7f.inf.w7_x64_signed
- %ProgramFiles%\ww2017cf\wm7f.sys.w7_x64_signed
- %WINDIR%\temp\udd453d.tmp
- %WINDIR%\temp\udd4dc6.tmp
- %WINDIR%\temp\uddf913.tmp
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\cbregist.cab
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\cbregistryevtmsg.dll
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\arm64\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\i386\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\i386\sha1\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\x64\cbregistry20.sys
- %WINDIR%\temp\{713cc6ce-b3e2-4fd9-838d-e28f558f6866}\x64\sha1\cbregistry20.sys
- C:\users\public\smr7\wm7installtemp\cbfsfilter20.dll
- C:\users\public\smr7\wm7installtemp\cbfsfilter2032.dll
- C:\users\public\smr7\wm7installtemp\foxsdku32w.dll
- C:\users\public\smr7\wm7clientpackage.cab
Moves the following files
- from <DRIVERS>\seteaf.tmp to <DRIVERS>\wm7f.sys
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Network activity
Connects to
- '10.#50.7.7':8150
Miscellaneous
Searches for the following windows
- ClassName: 'Win-Win7 32 Commander Class7' WindowName: ''
- ClassName: 'ScheduleTask' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\ww2017cf\wmcsystem7.exe'
- '%ProgramFiles%\ww2017cf\wmcupdater.exe' -smr_inst
- '%ProgramFiles%\ww2017cf\gcbsettings.exe' -backup
- '%ProgramFiles%\ww2017cf\wmcuser7.exe'
- '%ProgramFiles%\ww2017cf\wmcsystem7.exe' -di
- '%ProgramFiles%\ww2017cf\wmcsystem7.exe' -i
- '%ProgramFiles%\ww2017cf\scheduletask.exe' -SetSchedule
- '%WINDIR%\syswow64\regsvr32.exe' /i /s "%ProgramFiles%\WW2017CF\FoxSDKU32w.dll"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinMasterRC Slave7"' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WinMaster Client7"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinMasterFT Slave7"' (with hidden window)
- '%WINDIR%\syswow64\secedit.exe' /export /cfg C:\Users\Public\SecurityEdit.txt' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinMasterServices V7 Client7"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ICMPv4 Inbound"' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' export HKLM\SYSTEM\CurrentControlSet\Services\Win-Win7 "C:\Users\Public\SMR7\Debug\WinWin7.RegDebug.log"' (with hidden window)
- '<SYSTEM32>\auditpol.exe' /backup /file:C:\Users\Public\SystemAudit.txt' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WinMaster Client7" dir=in program="%ProgramFiles%\ww2017cf\wmcSystem7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfac...' (with hidden window)
- '%ProgramFiles%\ww2017cf\scheduletask.exe' -SetSchedule' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' export HKLM\SYSTEM\CurrentControlSet\Services\Win-Win7 "C:\Users\Public\SMR7\Debug\WinWin7.RegDebug.log"
- '<SYSTEM32>\auditpol.exe' /backup /file:C:\Users\Public\SystemAudit.txt
- '%WINDIR%\syswow64\secedit.exe' /export /cfg C:\Users\Public\SecurityEdit.txt
- '<SYSTEM32>\rundll32.exe' setupapi.dll,InstallHinfSection DefaultInstall 128 <DRIVERS>\WM7F.inf
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ICMPv4 Inbound"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\WW2017CF\XceedCry.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\WW2017CF\FoxSDKU32w.dll"
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinMasterServices V7 Client7"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinMasterRC Slave7"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="WinMasterFT Slave7"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WinMaster Client7"
- '%WINDIR%\syswow64\regsvr32.exe' /i /s "%ProgramFiles%\WW2017CF\FoxSDKU32w.dll"
