Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'WindowsUpdateCache' = '<Full path to file>|1783455065410'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\wsus\wuauclt.log
- %LOCALAPPDATA%\microsoft\windows\wsus\nyx_jna\jnidispatch.dll.new
- %LOCALAPPDATA%\microsoft\windows\wsus\nyx_host\3752\nyx_host.dll.new
- %LOCALAPPDATA%\microsoft\windows\wsus\wsus.lock
- %LOCALAPPDATA%\microsoft\windows\wsus\nyx_host\2444\nyx_host.dll.new
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\83aa4cc77f591dfc2374580bbd95f6ba_8cf7b530-613e-439b-a8c5-ccfc0e745400
- nul
Moves the following files
- from %LOCALAPPDATA%\microsoft\windows\wsus\nyx_jna\jnidispatch.dll.new to %LOCALAPPDATA%\microsoft\windows\wsus\nyx_jna\jnidispatch.dll
- from %LOCALAPPDATA%\microsoft\windows\wsus\nyx_host\3752\nyx_host.dll.new to %LOCALAPPDATA%\microsoft\windows\wsus\nyx_host\3752\nyx_host.dll
- from %LOCALAPPDATA%\microsoft\windows\wsus\nyx_host\2444\nyx_host.dll.new to %LOCALAPPDATA%\microsoft\windows\wsus\nyx_host\2444\nyx_host.dll
Network activity
TCP
Other
- 'ip##o.is':443
- 'ny##r.cc':443
UDP
- DNS ASK ip##o.is
- DNS ASK ny##r.cc
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "wmic cpu get Name /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' cpu get Name /format:csv
- '<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get Name /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get Name /format:csv
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
- '<SYSTEM32>\cmd.exe' /c "wmic csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /c "wmic logicaldisk where "DriveType=3" get Size /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk where "DriveType=3" get Size /format:csv
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmci"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\QEMU" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\QEMU"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\Parallels" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Parallels"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\Wine" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Wine"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\Cuckoo" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Cuckoo"
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\JoeBox" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\JoeBox"
- '<SYSTEM32>\cmd.exe' /c "tasklist /FO CSV /NH"
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /c "getmac /FO CSV /NH"
- '<SYSTEM32>\getmac.exe' /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /c "driverquery /FO CSV"
- '<SYSTEM32>\driverquery.exe' /FO CSV
- '<SYSTEM32>\cmd.exe' /c "wmic computersystem get Manufacturer,Model /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get Manufacturer,Model /format:csv
- '<SYSTEM32>\cmd.exe' /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' bios get Manufacturer,SMBIOSBIOSVersion /format:csv
- '<SYSTEM32>\cmd.exe' /c "net use"
- '<SYSTEM32>\net.exe' use
- '<SYSTEM32>\cmd.exe' /c "tasklist /NH"
- '<SYSTEM32>\tasklist.exe' /NH
- '<SYSTEM32>\cmd.exe' /c "reg query "HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall" /s 2>nul"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall" /s
- '<SYSTEM32>\cmd.exe' /c "wmic diskdrive get SerialNumber /format:csv"
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get SerialNumber /format:csv
- '<SYSTEM32>\cmd.exe' /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" 2>nul"
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState"
- '<SYSTEM32>\cmd.exe' /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "START|8CF7B530-613E-439B-A8C5-CCFC0E745400|%TEMP%\\out_8CF7B530-613E-439B-...
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "START|8CF7B530-613E-439B-A8C5-CCFC0E745400|%TEMP%\\out_8CF7B530-613E-439B-A8C5-CCF...
- '<SYSTEM32>\cmd.exe' /c "tasklist /V /FO CSV"
- '<SYSTEM32>\tasklist.exe' /V /FO CSV
- '<SYSTEM32>\cmd.exe' /c "ipconfig /all"
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\cmd.exe' /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "SYSINFO_DONE|8CF7B530-613E-439B-A8C5-CCFC0E745400|%TEMP%\\out_8CF7B530-613...
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "SYSINFO_DONE|8CF7B530-613E-439B-A8C5-CCFC0E745400|%TEMP%\\out_8CF7B530-613E-439B-A...
- '<Full path to file>' --watchdog 3752' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions' (with hidden window)
