Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\MVIDCYXA] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\MVIDCYXA] 'ImagePath' = '%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe'
- [HKLM\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\wokwsuwhtoix.sys'
Creates the following services
- 'MVIDCYXA' %ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe
- 'WinRing0_1_2_0' %WINDIR%\TEMP\wokwsuwhtoix.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following system processes:
- <SYSTEM32>\conhost.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\dcr\pb.exe
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\wheel
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\record
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\metadata
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\installer
- %TEMP%\_mei15242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
- %TEMP%\_mei15242\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei15242\certifi\cacert.pem
- %TEMP%\_mei15242\base_library.zip
- %TEMP%\_mei15242\_ssl.pyd
- %TEMP%\_mei15242\_sqlite3.pyd
- %TEMP%\_mei15242\_socket.pyd
- %TEMP%\_mei15242\_queue.pyd
- %TEMP%\_mei15242\_overlapped.pyd
- %TEMP%\_mei15242\_multiprocessing.pyd
- %TEMP%\_mei15242\_lzma.pyd
- %TEMP%\_mei15242\_hashlib.pyd
- %TEMP%\_mei15242\_decimal.pyd
- %TEMP%\_mei15242\_ctypes.pyd
- %TEMP%\_mei15242\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei15242\_bz2.pyd
- nul
- %TEMP%\_mei15242\_asyncio.pyd
- %TEMP%\_mei15242\vcruntime140_1.dll
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\license_files\license
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\license_files\license.bsd
- %WINDIR%\temp\wokwsuwhtoix.sys
- %TEMP%\_mei15242\cryptography\hazmat\bindings\_rust.pyd
- %ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe
- %TEMP%\_mei15242\win32com\shell\shell.pyd
- %TEMP%\_mei15242\win32\win32trace.pyd
- %TEMP%\_mei15242\win32\win32api.pyd
- %TEMP%\_mei15242\win32\_win32sysloader.pyd
- %TEMP%\_mei15242\unicodedata.pyd
- %TEMP%\_mei15242\sqlite3.dll
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\top_level.txt
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\entry_points.txt
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\wheel
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\record
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\metadata
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\license
- %TEMP%\_mei15242\setuptools-65.5.0.dist-info\installer
- %TEMP%\_mei15242\select.pyd
- %TEMP%\_mei15242\pywin32_system32\pywintypes311.dll
- %TEMP%\_mei15242\pywin32_system32\pythoncom311.dll
- %TEMP%\_mei15242\python311.dll
- %TEMP%\_mei15242\python3.dll
- %TEMP%\_mei15242\pyexpat.pyd
- %TEMP%\_mei15242\libssl-3.dll
- %TEMP%\_mei15242\libffi-8.dll
- %TEMP%\_mei15242\libcrypto-3.dll
- %TEMP%\_mei15242\vcruntime140.dll
- %TEMP%\_mei15242\cryptography-43.0.0.dist-info\license_files\license.apache
- %TEMP%\_mei15242\pythonwin\win32ui.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei15242\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei15242\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei15242\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei15242\crypto\cipher\_arc4.pyd
- %ALLUSERSPROFILE%\dcr\defendercompletelyremover.bat
- %ALLUSERSPROFILE%\dcr\work\toolsfordk.zip
- %ALLUSERSPROFILE%\dcr\work\nsudolc.exe
- %ALLUSERSPROFILE%\dcr\work\nircmd.exe
- %ALLUSERSPROFILE%\dcr\work\nhmb.exe
- %ALLUSERSPROFILE%\dcr\work\lgpo.exe
- %ALLUSERSPROFILE%\dcr\work\icon.ico
- %ALLUSERSPROFILE%\dcr\work\cecho.exe
- %ALLUSERSPROFILE%\dcr\work\7z.exe
- %ALLUSERSPROFILE%\dcr\wh.exe
- %TEMP%\_mei15242\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei15242\crypto\util\_strxor.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei15242\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei15242\crypto\publickey\_x25519.pyd
- %TEMP%\_mei15242\crypto\publickey\_ed448.pyd
- %TEMP%\_mei15242\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei15242\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei15242\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei15242\crypto\math\_modexp.pyd
- %TEMP%\_mei15242\crypto\hash\_poly1305.pyd
- %TEMP%\_mei15242\crypto\hash\_keccak.pyd
- %TEMP%\_mei15242\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei15242\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei15242\crypto\hash\_sha512.pyd
- %TEMP%\_mei15242\crypto\hash\_sha384.pyd
- %TEMP%\_mei15242\crypto\hash\_sha256.pyd
- %TEMP%\_mei15242\crypto\hash\_sha224.pyd
- %TEMP%\_mei15242\crypto\hash\_sha1.pyd
- %TEMP%\_mei15242\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei15242\crypto\hash\_md5.pyd
- %TEMP%\_mei15242\crypto\hash\_md4.pyd
- %TEMP%\_mei15242\crypto\hash\_md2.pyd
- %TEMP%\_mei15242\crypto\hash\_blake2s.pyd
- %TEMP%\_mei15242\crypto\hash\_blake2b.pyd
- %TEMP%\_mei15242\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei15242\pythonwin\mfc140u.dll
- %WINDIR%\temp\udda850.tmp
Deletes the following files
- %WINDIR%\temp\udda850.tmp
Network activity
UDP
- DNS ASK po##.#ashvault.pro
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\dcr\pb.exe'
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SHealthSer{#} {08}[Служба Центр безопасности Защитника Windows]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdNisDrv{#} {08}[Драйвер WD Network Inspection Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdBoot{#} {08}[Драйвер WD Antivirus Boot Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdFilter{#}{08} [Драйвер WD Antivirus Mini-Filter Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SgrmAgent{#}{08} [Драйвер System Guard Runtime Monitor Agent Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}wtd{#}{08} [Драйвер WTD Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsSecWfp{#}{08} [Драйвер Microsoft Security WFP Callout Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0c}wscsvc{#} {08}[Служба Центр обеспечения безопасности]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SgrmBroker{#} {08}[Служба Брокер мониторинга среды выполнения System Guard]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsSecFlt{#}{08} [Драйвер Security Events Component Minifilter]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Cache Maintenance{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Scheduled Scan{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Verification{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Windows Defender Cleanup{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SmartScreenSpecific{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0f}1{#} - {0c}Удалить Защитник Windows{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0f}2{#} - {0f}Проверить состояние папок и файлов Защитника{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsSecCore{#}{08} [Драйвер Microsoft Security Core Boot Driver]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {03}Состояние заданий в планировщике:{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}Sense{#} {08} [Служба Advanced Threat Protection]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}WdNisSvc{#} {08} [Служба проверки сети Windows Defender Antivirus]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0c}WinDefend{#} {08} [Служба Антивирусная программа Защитника Windows]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\nsudolc.exe' -U:T -P:E -UseCurrentConsole "%ALLUSERSPROFILE%\DCR\DefenderCompletelyRemover.bat"
- '%ALLUSERSPROFILE%\dcr\work\nircmd.exe' win center process cmd.exe
- '%ALLUSERSPROFILE%\dcr\work\nircmd.exe' win settext foreground "DCR"
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {03}Состояние процессов защитника:{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SmartScreen{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MsMpEng{#} {08} [Antimalware Service Executable]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SgrmBroker{#} {08}[Брокер среды выполнения System Guard]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}uhssvc{#} {08} [Microsoft Update Health Service]{\n #}
- '%ALLUSERSPROFILE%\dcr\wh.exe'
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}NisSrv{#} {08} [Network Realtime Inspection]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MPSigStub{#}{08} [Malware Protection Signature Update Stub]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}SHealthUI{#}{08} [Безопасность Windows]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}HealthTray{#}{08} [SecurityHealthSystray иконка в трее]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}HealthServ{#}{08} [SecurityHealthService]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}HealthHost{#}{08} [SecurityHealthHost]{\n #}{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {03}Состояние служб и драйверов защитника:{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}webthreat{#} {08}[Служба защиты от Веб-угроз - webthreatdefsvc]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}webthreatu{#} {08}[Служба защиты пользоват. от Веб-угроз - webthreatdefusersvc]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0a}MpCmdRun{#} {08} [Microsoft malware protection]{\n #}
- '%ALLUSERSPROFILE%\dcr\work\cecho.exe' {0f}3{#} - {0e}Восстановление защитника и др.{\n #}
- '%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\DCR\DefenderCompletelyRemover.bat" "
- '%WINDIR%\syswow64\sc.exe' query "WdNisDrv"
- '%WINDIR%\syswow64\sc.exe' query "WdBoot"
- '%WINDIR%\syswow64\sc.exe' query "WdFilter"
- '%WINDIR%\syswow64\sc.exe' query "SgrmAgent"
- '%WINDIR%\syswow64\sc.exe' query "wtd"
- '%WINDIR%\syswow64\sc.exe' query "MsSecWfp"
- '%WINDIR%\syswow64\sc.exe' query "MsSecFlt"
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' stop eventlog
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' delete "MVIDCYXA"
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' create "MVIDCYXA" binpath= "%ALLUSERSPROFILE%\twbjdgardowu\ppxxljhvvtep.exe" start= "auto"
- '%WINDIR%\syswow64\sc.exe' query "webthreatdefusersvc"
- '%WINDIR%\syswow64\sc.exe' query "MsSecCore"
- '%WINDIR%\syswow64\sc.exe' query "webthreatdefsvc"
- '%WINDIR%\syswow64\reg.exe' query "HKLM\System\CurrentControlSet\Services" /f "webthreatdefusersvc*" /k
- '%WINDIR%\syswow64\chcp.com' 866
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo "%ALLUSERSPROFILE%\DCR\" "
- '%WINDIR%\syswow64\findstr.exe' /c:"(" /c:")"
- '%WINDIR%\syswow64\reg.exe' query "HKU\S-1-5-19"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoLogonSID" 2>nul
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoLogonSID"
- '%WINDIR%\syswow64\cmd.exe' /c 2>nul reg query "HKLM\System\CurrentControlSet\Services" /f "webthreatdefusersvc*" /k|findstr H
- '%WINDIR%\syswow64\findstr.exe' H
- '%WINDIR%\syswow64\sc.exe' query "SgrmBroker"
- '%WINDIR%\syswow64\mode.com' 78,45
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
- '%WINDIR%\syswow64\find.exe' /i "0x0"
- '%WINDIR%\syswow64\sc.exe' query "WinDefend"
- '%WINDIR%\syswow64\sc.exe' query "WdNisSvc"
- '%WINDIR%\syswow64\sc.exe' query "Sense"
- '%WINDIR%\syswow64\sc.exe' query "wscsvc"
- '%WINDIR%\syswow64\sc.exe' query "SecurityHealthService"
- '<SYSTEM32>\sc.exe' start "MVIDCYXA"
