Divergent

KovCoreG’s attacks are socially engineered malvertisments that lure unwitting users into downloading a software package needed to update their supposedly out-of-date Adobe Flash application.

If the process is running with the appropriate privileges, it uses WMI (Windows Management Instrumentation) to query recognized anti-virus software installed on the host.

This script is set to execute as a task each time the computer starts. This is accomplished by creating a scheduled task with a random-looking service name that is set to run as the SYSTEM user at the highest run level.

It also uses a key in the registry to maintain persistence, and relies on PowerShell to install itself on the infected host.

The JScript in the reg key executes the following powershell...

the victim is intended to install one of these remote administration software.

This script is set to execute as a task each time the computer starts. This is accomplished by creating a scheduled task with a random-looking service name that is set to run as the SYSTEM user at the highest run level.

Like Kovter, it relies heavily on the registry for staging and storage of configuration data while avoiding more traditional on-access endpoint scanning of files on disk. | The data is stored in the pre-existing registry subkey to update the value... The second configuration is stored in the last remaining value in the ZfjrAilGdH registry subkey.

the HTA loader is written to the CSIDL_COMMON_APPDATA folder (typically C:\ProgramData\) and set to execute each time the user logs on by adding an entry to the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" registry key.

This script is set to execute as a task each time the computer starts. This is accomplished by creating a scheduled task with a random-looking service name that is set to run as the SYSTEM user at the highest run level.

the HTA loader is written to the CSIDL_COMMON_APPDATA folder (typically C:\ProgramData\) and set to execute each time the user logs on by adding an entry to the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" registry key.

It runs a shellcode to bypass User Account Control (UAC) via the CMSTPLUA COM interface (related to connection management).

The HTA is heavily obfuscated... While the requested resource features the extension normally associated with PNG images, it is actually malicious Powershell that has been encrypted using RC4.

killall: Terminate all processes initiated by the malware, delete corresponding files ... kill: Find process of specified component, terminate process, and delete the file

Once completed, it attempts to bypass UAC using CMSTP, if needed.

Its first task, however, is to install itself to the system in a less suspicious form, namely as an HTML Application (HTA) that will load the malware from the registry.

Once executed, the malware begins with five anti-analysis checks... It also checks for a host CPU with at least two cores, the presence of a debugger, and finally compares system uptime intervals to determine if the sample is running within a sandbox or virtual machine.

The malware checks for unwanted processes and loaded modules by hashing process file names and module names respectively, then comparing each hash against two separate pre-computed lists for each.

Using COM objects, the DLL launches an instance of Internet Explorer, resizes the window to fit the entire screen... Additionally, the DLL hides the Windows taskbar so the user is more compelled to comply with any instructions on the page that is presented to them.

The malware reads all the information embedded in its data section and creates three new randomly named registry keys, each holding a different stage of the loader code needed to execute the malware PE using reflective injection.

Like Kovter, it relies heavily on the registry for staging and storage of configuration data while avoiding more traditional on-access endpoint scanning of files on disk. | The data is stored in the pre-existing registry subkey to update the value... The second configuration is stored in the last remaining value in the ZfjrAilGdH registry subkey.

A process list is gathered and sent to the URL hxxps://uoibppop[.]tk/clean; no response is expected from the server.

These URLs are later contacted with a comprehensive set of sensitive information from the host.

Once executed, the malware begins with five anti-analysis checks... It also checks for a host CPU with at least two cores, the presence of a debugger, and finally compares system uptime intervals to determine if the sample is running within a sandbox or virtual machine.

The malware checks for unwanted processes and loaded modules by hashing process file names and module names respectively, then comparing each hash against two separate pre-computed lists for each.

This new connection uses Socket.IO web sockets to maintain continuous communication between the victim and the server so the server can periodically send commands. | Empty POST requests are sent to each of the URLs in the first configuration's accl key... The second server contain the host address of an advertisement revenue service and the entire HTTP request that should be made to that server.

Using this data, the malware sends additional requests to download each specified file. The files are written to disk and executed.

it is likely that the victim is intended to install one of these remote administration software.

If found, it proceeds to disable various components of Windows Defender and Windows Updates.

If found, it proceeds to disable various components of Windows Defender and Windows Updates.