Trojan.BAT.BATCLOAK.THJBDBC

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Application Data%\Network48336Man.cmd

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops and executes the following files:

• Copies of %System%\WindowsPowershell\v1.0\powershell.exe :
  • {Malware Path}\{Malware Filename and Extension}.exe
  • %Application Data%\Network48336Man.cmd.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• {Malware Filename and Extension}.exe {Powershell Script to decrypt and reflectively load the malicious payload}
• powershell.exe $a = [System.Diagnostics.Process]::GetProcessById({Process ID});$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
• powershell.exe add-mppreference -exclusionpath @({List of Available Drives})
• "powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('{Malware Path}\{Malware Filename}')
• powershell.exe Register-ScheduledTask -TaskName 'OneNote 48336' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute '%Application Data%\Network48336Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
• cmd /c ""%Application Data%\Network48336Man.cmd" "

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

The scheduled task executes the malware every:

• Logon

Other Details

This Trojan does the following:

• It reflectively loads the encrypted payloads.
• It bypasses the Antimalware Scan Interface (AMSI).
• Terminates if found being executed in a debugger.
• Sets the attribute of the copied powershell.exe ({Malware Path}\{Malware Filename and Extension}.exe) to HIDDEN.
• Deletes the copied powershell.exe after execution.
• It adds the available drives to the exclusion path list of Windows Defender.

It adds the following scheduled tasks:

• Task Name: OneNote 48336
  Trigger: At Logon
  Task Action: %Application Data%\Network48336Man.cmd

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)