Trojan.PS1.POWTRAN.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\WindowsPowerShell\v1.0\WinRing0x64.sys ->Allows XMRig to boost mining capability
• %System%\mue.exe -> Detected as Coinminer.Win64.MALXMR.TDI

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• powercfg /CHANGE -standby-timeout-ac 0
• powercfg /CHANGE -hibernate-timeout-ac 0
• powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
• powershell -NoP -NonI -W Hidden -exec bypass `"`$fun={base-64 encoded script};`$defun=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(`$fun));iex `$defun;iex ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('$EncodedScript'))) - For Windows 10
• powershell -NoP -NonI -W Hidden -exec bypass -E {base-64 encoded script} - For Windows 7
• netstat -anop tcp
• %System%\schtasks.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It injects codes into the following process(es):

• %System%\schtasks.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Trojan deletes the following files:

• %Temp%\gpt.ps1

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• Processes that have an ESTABLISHED network connection via port 3333, 5555, 7777
• Processes that have an ESTABLISHED network connection via port 49636, 14444, 14433, 80, 443

Download Routine

This Trojan accesses the following websites to download files:

• http://{BLOCKED}.net/bannerl
• http://{BLOCKED}.net/sync
• https://raw.{BLOCKED}.com/{BLOCKED}up/master/domtar

Other Details

This Trojan does the following:

• It may connect to the following mining pool:
  • xmr-{BLOCKED}.org:14444
  • xmr-asia1.{BLOCKED}.org:14444
  • xmr-us-west1.{BLOCKED}.org:14444
  • xmr-us-east1.{BLOCKED}.org:14444
  • xmr-eu2.{BLOCKED}.org:14444
  • mine.{BLOCKED}.net:80
  • pool.{BLOCKED}.com:80
• It is capable of propagating in the local network via the following means:
  • Mimikatz

It uses Windows Management Instrumentation (WMI) to do the following:

• WMI Event Subscription:
  For Windows 10:
  • It creates the following WMI Classes under ROOT\subscription to achieve persistence in the system:
  • __FilterToConsumerBinding
  • Filter: SCM Event6 Log Filter
  • Consumer: SCM Event6 Log Consumer
  • __EventFilter
  • Name: SCM Event6 Log Filter
  • QueryLanguage: WQL
  • Query: SELECT * FROM __InstanceModificationEvent WITHIN 13600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
  • __CommandLineEventConsumer:
  • Name: SCM Event6 Log Consumer
  • CommandLineTemplate: powershell -NoP -NonI -W Hidden -exec bypass `"`$fun={base64 encoded command};`$defun=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(`$fun));iex `$defun;`$mon = ([WmiClass] 'root\default:systemcore_Updater6').Properties['mon'].Value;`$funs = ([WmiClass] 'root\default:systemcore_Updater6').Properties['funs'].Value ;iex ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(`$funs)));Invoke-Command -ScriptBlock `$RemoteScriptBlock -ArgumentList @(`$mon, `$mon, 'Void', 0, '', '')`"
  
  
  • __FilterToConsumerBinding
  • Filter: SCM Event6 Log Filter2
  • Consumer: SCM Event6 Log Consumer2
  • __EventFilter
  • Name: SCM Event6 Log Filter2
  • QueryLanguage: WQL
  • Query: SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 301
  • __CommandLineEventConsumer:
  • Name: SCM Event6 Log Consumer2
  • CommandLineTemplate: : powershell -NoP -NonI -W Hidden -exec bypass `"`$fun='{base64 encoded command}';`$defun=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(`$fun));iex `$defun;`$mon = ([WmiClass] 'root\default:systemcore_Updater6').Properties['mon'].Value;`$funs = ([WmiClass] 'root\default:systemcore_Updater6').Properties['funs'].Value ;iex ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(`$funs)));Invoke-Command -ScriptBlock `$RemoteScriptBlock -ArgumentList @(`$mon, `$mon, 'Void', 0, '', '')`"

For Windows 7:
• It creates the following WMI Classes under ROOT\subscription to achieve persistence in the system:
• __FilterToConsumerBinding
• Filter: SCM Event6 Log Filter
• Consumer: SCM Event6 Log Consumer
• __EventFilter
• Name: SCM Event6 Log Filter
• QueryLanguage: WQL
• Query: SELECT * FROM __InstanceModificationEvent WITHIN 13600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
• __CommandLineEventConsumer:
• Name: SCM Event6 Log Consumer
• CommandLineTemplate: powershell -NoP -NonI -W Hidden -exec bypass -E {base-64 encoded script}"


• __FilterToConsumerBinding
• Filter: SCM Event6 Log Filter2
• Consumer: SCM Event6 Log Consumer2
• __EventFilter
• Name: SCM Event6 Log Filter2
• QueryLanguage: WQL
• Query: SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 301"
• __CommandLineEventConsumer:
• Name: SCM Event6 Log Consumer2
• CommandLineTemplate: powershell -NoP -NonI -W Hidden -exec bypass -E {base-64 encoded script}