Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'PhysicsCore' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'PhysicsCore' = '%TEMP%\svc_sIixToWy.exe'
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\svc_siixtowy.exe
- %TEMP%\bg.jpg
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699158ef-62c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699158ef-e54.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699158f5-6b4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699158f5-c14.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699158f5-c24.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5c54e934121b5480_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\dc8b5983c47f44e2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\447725eee272d141_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\84584a18dc98bd84_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a7fc0ed5200c10d6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0744ebf27f3ab27b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\29d2572c3b4bfcf3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_www.youtube.com_0.indexeddb.leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_www.youtube.com_0.indexeddb.leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_www.youtube.com_0.indexeddb.leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1bc97e82e8fcb916_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b1918f6247d8c61f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\80dd14fd1aa6bb54_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\27b4cf57986b0561_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\40bf3eaf0e6fd2ae_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c61ca46833c7bac4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5af777ffbcb34b19_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\17d9b597b442d231_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\699d287dbfbb2b6f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\db75582fc14d190b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39ed7828-39ec-47cb-bc4e-16ceb1c90e5d\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39ed7828-39ec-47cb-bc4e-16ceb1c90e5d\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f4455d1cfc2d9218_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\20e9d2c03dc412c8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3de152fe21cb837f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9a39aef1bf33b523_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fd8736c70cf70087_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\37c4e7075192716a_0
- %TEMP%\a3c35c98-112b-4bd1-ac99-043286a6bc75.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\335e69ddec2b9ac6_0
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\335e69ddec2b9ac6_0
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_www.youtube.com_0.indexeddb.leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39ed7828-39ec-47cb-bc4e-16ceb1c90e5d\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39ed7828-39ec-47cb-bc4e-16ceb1c90e5d\index-dir\the-real-index
Modifies the following files
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %TEMP%\.ses
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'im##.##arch.brave.com':443
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.####ca1.amazontrust.com':80
- 'co####.edge.skype.com':443
- 'yo##ube.com':443
- 'i.##img.com':443
- 'fo###.#oogleapis.com':443
- 'rr##########onuxaxjvh-n8v6.googlevideo.com':443
- 'fo###.gstatic.com':443
- 'rr##########onuxaxjvh-n8vs.googlevideo.com':443
- 'accounts.google.com':443
- 'rr########g5e6nze.googlevideo.com':443
- 'go######s.g.doubleclick.net':443
- 'rr########g5edndl.googlevideo.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?32##############
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f##############
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
Other
- 'im##.##arch.brave.com':443
- 'co####.edge.skype.com':443
- 'yo##ube.com':443
- 'i.##img.com':443
- 'rr#######5goeenez.c.youtube.com':443
- 'rr##########onuxaxjvh-n8v6.googlevideo.com':443
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
- 'rr#######5go7ynld.c.youtube.com':443
- 'rr##########onuxaxjvh-n8vs.googlevideo.com':443
- 'accounts.google.com':443
- 'google.com':443
- 'rr########g5e6nze.googlevideo.com':443
- 'gs##tic.com':443
- 'go######s.g.doubleclick.net':443
- 'rr########g5edndl.googlevideo.com':443
UDP
- DNS ASK im##.##arch.brave.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK co####.edge.skype.com
- DNS ASK yo##ube.com
- DNS ASK i.##img.com
- DNS ASK rr#######5goeenez.c.youtube.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK rr##########onuxaxjvh-n8v6.googlevideo.com
- DNS ASK fo###.gstatic.com
- DNS ASK rr#######5go7ynld.c.youtube.com
- DNS ASK rr##########onuxaxjvh-n8vs.googlevideo.com
- DNS ASK accounts.google.com
- DNS ASK google.com
- DNS ASK rr########g5e6nze.googlevideo.com
- DNS ASK gs##tic.com
- DNS ASK go######s.g.doubleclick.net
- DNS ASK rr########g5edndl.googlevideo.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Creates and executes the following
- '%TEMP%\svc_siixtowy.exe' --monitor 4740
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.youtube.com/watch?v=8d8Ae0Zgtsg
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.youtube.com/watch?v=8d8Ae0Zgtsg
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.youtube.com/watch?v=8d8Ae0Zgtsg' (with hidden window)
