Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Explorer' = '%WINDIR%\system\explorer.exe RO'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Svchost' = '%WINDIR%\system\svchost.exe RO'
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%WINDIR%\explorer.exe, %WINDIR%\system\explorer.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}] 'StubPath' = '%APPDATA%\mrsys.exe MR'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}] 'StubPath' = '%APPDATA%\mrsys.exe MR'
Creates or modifies the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Schedule] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Executes the following
- '%WINDIR%\syswow64\at.exe' 17:20 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe
- '%WINDIR%\syswow64\at.exe' 17:21 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe
Modifies file system
Creates the following files
- %HOMEPATH%\documents\ps\uninstal.$$a
- %HOMEPATH%\documents\ps\_asyncio.$$a
- %HOMEPATH%\documents\ps\vcruntime140.$$a
- %HOMEPATH%\documents\ps\unicodedata.$$a
- %HOMEPATH%\documents\ps\ucrtbase.$$a
- %HOMEPATH%\documents\ps\select.$$a
- %HOMEPATH%\documents\ps\python38.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-time-l1-1-0.$$a
- %HOMEPATH%\documents\ps\pyexpat.$$a
- %HOMEPATH%\documents\ps\libssl-1_1.$$a
- %HOMEPATH%\documents\ps\libffi-7.$$a
- %HOMEPATH%\documents\ps\libcrypto-1_1.$$a
- %HOMEPATH%\documents\ps\host.$$a
- %HOMEPATH%\documents\ps\host.exe.$$a
- %HOMEPATH%\documents\ps\base_library.$$a
- %HOMEPATH%\documents\ps\ps.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-utility-l1-1-0.$$a
- %HOMEPATH%\documents\ps\_bz2.$$a
- %HOMEPATH%\documents\ps\_ssl.$$a
- %WINDIR%\system\svchost.exe
- %WINDIR%\system\spoolsv.exe
- %WINDIR%\system\explorer.exe
- %LOCALAPPDATA%\icsys.icn.exe
- %HOMEPATH%\desktop\ps.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\instalador ps\uninstall instalador ps.lnk
- %HOMEPATH%\documents\ps\_decimal.$$a
- %HOMEPATH%\documents\ps\_ctypes.$$a
- %HOMEPATH%\documents\ps\_socket.$$a
- %HOMEPATH%\documents\ps\_queue.$$a
- %HOMEPATH%\documents\ps\_overlapped.$$a
- %HOMEPATH%\documents\ps\_multiprocessing.$$a
- %HOMEPATH%\documents\ps\_lzma.$$a
- %HOMEPATH%\documents\ps\_hashlib.$$a
- %HOMEPATH%\documents\ps\uninstal.exe
- %HOMEPATH%\documents\ps\api-ms-win-crt-string-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-stdio-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-runtime-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-memory-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-localization-l1-2-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-libraryloader-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-interlocked-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-heap-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-processenvironment-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-handle-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-2-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-errorhandling-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-debug-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-datetime-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-console-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-file-l2-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-namedpipe-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-1.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-process-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-conio-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-math-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-locale-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-heap-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-filesystem-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-environment-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-crt-convert-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-util-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-profile-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-timezone-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-sysinfo-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-2-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-string-l1-1-0.$$a
- %HOMEPATH%\documents\ps\api-ms-win-core-rtlsupport-l1-1-0.$$a
- %APPDATA%\mrsys.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
Sets the 'hidden' attribute to the following files
- %WINDIR%\system\explorer.exe
- %WINDIR%\system\spoolsv.exe
- %WINDIR%\system\svchost.exe
- %APPDATA%\mrsys.exe
Deletes the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Moves the following files
- from %HOMEPATH%\documents\ps\uninstal.$$a to %HOMEPATH%\documents\ps\uninstal.exe
- from %HOMEPATH%\documents\ps\api-ms-win-crt-process-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-process-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-runtime-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-runtime-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-stdio-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-stdio-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-string-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-string-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-time-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-time-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-utility-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-utility-l1-1-0.dll
- from %HOMEPATH%\documents\ps\base_library.$$a to %HOMEPATH%\documents\ps\base_library.zip
- from %HOMEPATH%\documents\ps\host.exe.$$a to %HOMEPATH%\documents\ps\host.exe.manifest
- from %HOMEPATH%\documents\ps\host.$$a to %HOMEPATH%\documents\ps\host.exeВ
- from %HOMEPATH%\documents\ps\libcrypto-1_1.$$a to %HOMEPATH%\documents\ps\libcrypto-1_1.dll
- from %HOMEPATH%\documents\ps\libffi-7.$$a to %HOMEPATH%\documents\ps\libffi-7.dll
- from %HOMEPATH%\documents\ps\libssl-1_1.$$a to %HOMEPATH%\documents\ps\libssl-1_1.dll
- from %HOMEPATH%\documents\ps\ps.$$a to %HOMEPATH%\documents\ps\ps.exe
- from %HOMEPATH%\documents\ps\python38.$$a to %HOMEPATH%\documents\ps\python38.dll
- from %HOMEPATH%\documents\ps\_socket.$$a to %HOMEPATH%\documents\ps\_socket.pyd
- from %HOMEPATH%\documents\ps\select.$$a to %HOMEPATH%\documents\ps\select.pyd
- from %HOMEPATH%\documents\ps\ucrtbase.$$a to %HOMEPATH%\documents\ps\ucrtbase.dll
- from %HOMEPATH%\documents\ps\unicodedata.$$a to %HOMEPATH%\documents\ps\unicodedata.pyd
- from %HOMEPATH%\documents\ps\vcruntime140.$$a to %HOMEPATH%\documents\ps\vcruntime140.dll
- from %HOMEPATH%\documents\ps\_asyncio.$$a to %HOMEPATH%\documents\ps\_asyncio.pyd
- from %HOMEPATH%\documents\ps\_bz2.$$a to %HOMEPATH%\documents\ps\_bz2.pyd
- from %HOMEPATH%\documents\ps\_ctypes.$$a to %HOMEPATH%\documents\ps\_ctypes.pyd
- from %HOMEPATH%\documents\ps\_decimal.$$a to %HOMEPATH%\documents\ps\_decimal.pyd
- from %HOMEPATH%\documents\ps\_hashlib.$$a to %HOMEPATH%\documents\ps\_hashlib.pyd
- from %HOMEPATH%\documents\ps\_lzma.$$a to %HOMEPATH%\documents\ps\_lzma.pyd
- from %HOMEPATH%\documents\ps\_multiprocessing.$$a to %HOMEPATH%\documents\ps\_multiprocessing.pyd
- from %HOMEPATH%\documents\ps\_overlapped.$$a to %HOMEPATH%\documents\ps\_overlapped.pyd
- from %HOMEPATH%\documents\ps\_queue.$$a to %HOMEPATH%\documents\ps\_queue.pyd
- from %HOMEPATH%\documents\ps\api-ms-win-crt-math-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-math-l1-1-0.dll
- from %HOMEPATH%\documents\ps\pyexpat.$$a to %HOMEPATH%\documents\ps\pyexpat.pyd
- from %HOMEPATH%\documents\ps\api-ms-win-crt-locale-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-locale-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-namedpipe-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-namedpipe-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-console-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-console-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-datetime-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-datetime-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-debug-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-debug-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-errorhandling-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-errorhandling-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-2-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-file-l1-2-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-file-l2-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-file-l2-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-handle-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-handle-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-heap-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-heap-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-interlocked-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-interlocked-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-libraryloader-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-libraryloader-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-localization-l1-2-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-localization-l1-2-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-memory-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-memory-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-processenvironment-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-processenvironment-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-filesystem-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-filesystem-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-1.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-processthreads-l1-1-1.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-profile-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-profile-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-rtlsupport-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-rtlsupport-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-string-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-string-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-2-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-synch-l1-2-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-sysinfo-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-sysinfo-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-timezone-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-timezone-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-core-util-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-core-util-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-conio-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-conio-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-convert-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-convert-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-environment-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-environment-l1-1-0.dll
- from %HOMEPATH%\documents\ps\api-ms-win-crt-heap-l1-1-0.$$a to %HOMEPATH%\documents\ps\api-ms-win-crt-heap-l1-1-0.dll
- from %HOMEPATH%\documents\ps\_ssl.$$a to %HOMEPATH%\documents\ps\_ssl.pyd
Substitutes the following files
- %HOMEPATH%\documents\ps\ps.$$a
- %HOMEPATH%\documents\ps\ps.exeВ
Miscellaneous
Searches for the following windows
- ClassName: 'InstItClass' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\documents\ps\ps.exe'
- '%LOCALAPPDATA%\icsys.icn.exe'
- '%WINDIR%\system\explorer.exe'
- '%WINDIR%\system\spoolsv.exe' SE
- '%WINDIR%\system\svchost.exe'
- '%WINDIR%\system\spoolsv.exe' PR
Executes the following
- '%LOCALAPPDATA%\icsys.icn.exe' ' (with hidden window)
- '%WINDIR%\system\explorer.exe' ' (with hidden window)
- '%WINDIR%\system\spoolsv.exe' SE' (with hidden window)
- '%WINDIR%\system\svchost.exe' ' (with hidden window)
- '%WINDIR%\system\spoolsv.exe' PR' (with hidden window)
- '%WINDIR%\syswow64\at.exe' 17:20 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe' (with hidden window)
- '%WINDIR%\syswow64\at.exe' 17:21 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe' (with hidden window)
