Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinDivert] 'ImagePath' = '%WINDIR%\WinDivert64.sys'
Creates the following services
- 'WinDivert' %WINDIR%\WinDivert64.sys
Modifies file system
Creates the following files
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\loader.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_bz2.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_cffi_backend.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_ctypes.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_decimal.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_elementtree.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_hashlib.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_lzma.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_queue.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_socket.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\_ssl.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\libcrypto-1_1.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\libffi-7.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\libssl-1_1.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pyexpat.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\python3.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\python310.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pythoncom310.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pywintypes310.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\select.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\unicodedata.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\vcruntime140.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\vcruntime140_1.dll
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\win32security.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pil\_avif.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pil\_imaging.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pil\_imagingcms.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pil\_imagingft.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pil\_imagingmath.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pil\_webp.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\certifi\cacert.pem
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\charset_normalizer\cd.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\charset_normalizer\md.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\nacl\_sodium.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\psutil\_psutil_windows.pyd
- %TEMP%\onefile_3572_851102_sk3ad9sxlks\pyinjector\injector.pyd
- %TEMP%\n7gd6vor
- %TEMP%\tmpt5dzx6dc
- %TEMP%\tmpdtx0t4vx
- nul
- %WINDIR%\localhost.crt
- %WINDIR%\windivert64.dll
- %WINDIR%\windivert64.sys
- C:\users\mcfijvihwi.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\localhost.crt
- C:\users\mcfijvihwi.exe
Deletes the following system files
- <DRIVERS>\etc\hosts
Deletes following files that it created itself
- %TEMP%\n7gd6vor
- %TEMP%\tmpt5dzx6dc
- %TEMP%\tmpdtx0t4vx
- %WINDIR%\localhost.crt
Substitutes the HOSTS file.
Deletes itself.
Miscellaneous
Adds a root certificate
Creates and executes the following
- 'C:\users\mcfijvihwi.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c cls||clear
- '<SYSTEM32>\cmd.exe' /c "netsh interface portproxy delete v4tov4 listenaddress=16#.#59.133.234 listenport=443"
- '<SYSTEM32>\netsh.exe' interface portproxy delete v4tov4 listenaddress=16#.#59.133.234 listenport=443
- '<SYSTEM32>\cmd.exe' /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=16#.#59.133.234"
- '<SYSTEM32>\netsh.exe' interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=16#.#59.133.234
- '<SYSTEM32>\takeown.exe' /F %WINDIR%\localhost.crt
- '<SYSTEM32>\icacls.exe' %WINDIR%\localhost.crt /grant Administrators:F
- '<SYSTEM32>\takeown.exe' /F %WINDIR%\localhost.key
- '<SYSTEM32>\icacls.exe' %WINDIR%\localhost.key /grant Administrators:F
- '<SYSTEM32>\certutil.exe' -addstore Root %WINDIR%\localhost.crt
- '<SYSTEM32>\cmd.exe' /c "ipconfig /flushdns"
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c "netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=16#.#59.133.234 mask=255.255.255.255"
- '<SYSTEM32>\netsh.exe' interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=16#.#59.133.234 mask=255.255.255.255
- '<SYSTEM32>\cmd.exe' /c "netsh interface portproxy add v4tov4 listenaddress=16#.#59.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443"
- '<SYSTEM32>\netsh.exe' interface portproxy add v4tov4 listenaddress=16#.#59.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c start "" "C:\Users\MCFIJVIhwI.exe"
- '<SYSTEM32>\cmd.exe' /c "netsh interface portproxy show all"
- '<SYSTEM32>\netsh.exe' interface portproxy show all
- '<SYSTEM32>\cmd.exe' /c "sc stop WinDivert"
- '<SYSTEM32>\sc.exe' stop WinDivert
- '<SYSTEM32>\cmd.exe' /c "sc delete WinDivert"
- '<SYSTEM32>\sc.exe' delete WinDivert
- '<SYSTEM32>\cmd.exe' /c "sc create WinDivert type= kernel start= demand binPath= "%WINDIR%\WinDivert64.sys" DisplayName= "WinDivert Network Driver""
- '<SYSTEM32>\sc.exe' create WinDivert type= kernel start= demand binPath= "%WINDIR%\WinDivert64.sys" DisplayName= "WinDivert Network Driver"
- '<SYSTEM32>\cmd.exe' /c "sc start WinDivert"
- '<SYSTEM32>\sc.exe' start WinDivert
- '<SYSTEM32>\cmd.exe' /c "netsh interface portproxy delete v4tov4 listenaddress=16#.#59.133.234 listenport=443"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=16#.#59.133.234"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ipconfig /flushdns"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=16#.#59.133.234 mask=255.255.255.255"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh interface portproxy add v4tov4 listenaddress=16#.#59.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh interface portproxy show all"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop WinDivert"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc delete WinDivert"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc create WinDivert type= kernel start= demand binPath= "%WINDIR%\WinDivert64.sys" DisplayName= "WinDivert Network Driver""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc start WinDivert"' (with hidden window)
