Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\clr_optimization_v2.0.19857_x64] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\clr_optimization_v2.0.19857_x64] 'ImagePath' = '%WINDIR%\SysWOW64\WerlFault.exe'
- [<HKLM>\System\CurrentControlSet\Services\WindowsSearch] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WindowsSearch] 'ImagePath' = '<SYSTEM32>\WindowsSearch.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop SRPolicySvc
Modifies file system
Creates the following files
- %PROGRAMDATA%\microsoft\network\lsass.exe
- %WINDIR%\syswow64\werlfault.exe
- %WINDIR%\syswow64\parameters.ini
- %WINDIR%\syswow64\proceslist.txt
- %WINDIR%\syswow64\autocloseexe.txt
- %WINDIR%\syswow64\windowssearch.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\windowssearch.exe
- %WINDIR%\syswow64\parameters.ini
Network activity
TCP
HTTP GET requests
- http://14#.#8.64.41/Downloads/lssas/lsass.txt
- http://sp###.#ainsis.online/Downloads/lssas/version.txt
UDP
- DNS ASK sp###.#ainsis.online
- DNS ASK sm.####esab.services
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\microsoft\network\lsass.exe'
- '%WINDIR%\syswow64\werlfault.exe' install clr_optimization_v2.0.19857_x64 %PROGRAMDATA%\Microsoft\Network\lsass.exe
- '%WINDIR%\syswow64\werlfault.exe'
- '%WINDIR%\syswow64\windowssearch.exe'
- '%PROGRAMDATA%\microsoft\network\lsass.exe' ' (with hidden window)
- '%WINDIR%\syswow64\werlfault.exe' install clr_optimization_v2.0.19857_x64 %PROGRAMDATA%\Microsoft\Network\lsass.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc description clr_optimization_v2.0.19857_x64 "Microsoft .NET Framework NGEN"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc start clr_optimization_v2.0.19857_x64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop SRPolicySvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete SRPolicySvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\FrameworkUI.exe install SRPolicySvc %WINDIR%\LiveKernel\SRPolicySvc.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc description SRPolicySvc "Executes diagnostic actions support"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc config SRPolicySvc DisplayName= "Microsoft FrameworkUI "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc start SRPolicySvc' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc description clr_optimization_v2.0.19857_x64 "Microsoft .NET Framework NGEN"
- '%WINDIR%\syswow64\sc.exe' description clr_optimization_v2.0.19857_x64 "Microsoft .NET Framework NGEN"
- '%WINDIR%\syswow64\cmd.exe' /c sc start clr_optimization_v2.0.19857_x64
- '%WINDIR%\syswow64\sc.exe' start clr_optimization_v2.0.19857_x64
- '%WINDIR%\syswow64\cmd.exe' /c net stop SRPolicySvc
- '%WINDIR%\syswow64\net1.exe' stop SRPolicySvc
- '%WINDIR%\syswow64\cmd.exe' /c sc delete SRPolicySvc
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\FrameworkUI.exe install SRPolicySvc %WINDIR%\LiveKernel\SRPolicySvc.exe
- '%WINDIR%\syswow64\sc.exe' delete SRPolicySvc
- '%WINDIR%\syswow64\cmd.exe' /c sc description SRPolicySvc "Executes diagnostic actions support"
- '%WINDIR%\syswow64\sc.exe' description SRPolicySvc "Executes diagnostic actions support"
- '%WINDIR%\syswow64\cmd.exe' /c sc config SRPolicySvc DisplayName= "Microsoft FrameworkUI "
- '%WINDIR%\syswow64\sc.exe' config SRPolicySvc DisplayName= "Microsoft FrameworkUI "
- '%WINDIR%\syswow64\cmd.exe' /c sc start SRPolicySvc
- '%WINDIR%\syswow64\sc.exe' start SRPolicySvc
- '%WINDIR%\syswow64\wbem\wmic.exe' path CIM_VideoController get name
