.exe”[PID 6348] creates a subprocess “Windows.Globalization.Fontgroups.exe”[PID 3848] which the persistence runs.

When analyzing the “Windows.Globalization.Fontgroups.exe”[PID 3848], I could see that it was packed with UPX, which is pretty easy to unpack.

After unpacking, I noticed that there was another layer of packing. This time, it was with AutoIT. Moving forward with the analysis, I found that this binary is responsible for enumerating the OS in order to find new browsers and resources that it can steal information from:

The “Windows.Globalization.Fontgroups.exe”[PID 3848] creates a process called “Windows.Globalization.Fontgroups.module.exe”[PID 3848] which is responsible for creating the zip file with all the information “bin.exe”[PID 8604] sends out:

C:\Users\shy32\AppData\Roaming\amd64_netfx4-system.runti..dowsruntime.ui.xaml\ENU_64B5614D0F4B35423983.7z

The “Windows.Globalization.Fontgroups.exe”[PID 3848] uses “Attrib.exe”[PID 8832] in order to hide this directory:

Prevention and Remediation

Remediation

Download the Reason Antivirus software.

Doubleclick on the installed executable and follow the prompts to complete the installation.

Once the installation is complete, click ‘Finish’.

Definitions and security patches will automatically be updated.

Once the process is complete, select the ‘Scan Now’ button to start your scan.

When the scan is finished, select all the threats that were detected and then click on ‘Remove selected threats’. When prompted, restart your computer.

MetaData

hashes

2b35aa9c70ef66197abfb9bc409952897f9f70818633ab43da85b3825b256307

0b3e7faa3ad28853bb2b2ef188b310a67663a96544076cd71c32ac088f9af74d

13c0165703482dd521e1c1185838a6a12ed5e980
.exe”[PID 6348 ] creates a subprocess “ Windows. Globalization. Fontgroups.exe”[PID 3848 ] which the persistence runs. 

 When analyze the “ Windows. Globalization. Fontgroups.exe”[PID 3848 ], I could examine that it was packed with UPX, which is pretty easy to unpack. 

 After unpack, I noticed that there was another layer of packing material. This prison term, it was with AutoIT. Moving forth with the analysis, I found that this binary star is responsible for enumerating the OS in order to rule new browsers and resources that it can steal information from: 

 The “ Windows. Globalization. Fontgroups.exe”[PID 3848 ] creates a procedure called “ Windows. Globalization. Fontgroups.module.exe”[PID 3848 ] which is responsible for creating the slide fastener file with all the information “ bin.exe”[PID 8604 ] sends out: 

 C:\Users\shy32\AppData\Roaming\amd64_netfx4 - system.runti.. dowsruntime.ui.xaml\ENU_64B5614D0F4B35423983.7z 

 The “ Windows. Globalization. Fontgroups.exe”[PID 3848 ] uses “ Attrib.exe”[PID 8832 ] in order to shroud this directory: 

 Prevention and Remediation 

 Remediation 

 Download the Reason Antivirus software. 

 Doubleclick on the installed executable and follow the prompts to complete the facility. 

 Once the installation is complete, click ‘ Finish ’. 

 Definitions and security patches will automatically be updated. 

 Once the process is complete, select the ‘ Scan Now ’ button to start your scan. 

 When the scan is finished, select all the menace that were detected and then click on ‘ murder choose terror ’. When prompted, restart your calculator. 

 MetaData 

 hashes 

 2b35aa9c70ef66197abfb9bc409952897f9f70818633ab43da85b3825b256307 

 0b3e7faa3ad28853bb2b2ef188b310a67663a96544076cd71c32ac088f9af74d 

 13c0165703482dd521e1c1185838a6a12ed5e980
.exe”[OID 6348] creates a subprocesr “Windows.Globalnzation.Hontgrohps.exe”[PIA 3848] which the persistence rund.

Wyen abalyzing the “Windows.Glubalizatiln.Fontgriups.txe”[PID 3848], I could sxs that lc was iackeb xith UPX, which ls pretty edsy to unpack.

Axtdr unpacking, I noticed that there was anothet payer of packigg. Tnys tjme, it was with AutoIT. Moving forwzrd witi the analysis, O found that this binary id redponsible for enumfrating the OS yb order to fknd new browsers and rgsources that it can steal inforoatiou from:

The “Wuneowd.Clobalizatiin.Fonngroups.exe”[PID 3848] createv a provess called “Wikdows.Jlobqlization.Fontgroups.movule.exe”[PID 3848] which is responsitlz for creating the zip dile fith all rhe inrocmafion “bln.eee”[PID 8604] senda out:

C:\Users\why32\AppData\Roaming\amc64_nqngx4-system.runtj..dowsrtneime.ui.xaml\ENU_64B5614D0F4B35423983.7z

The “Windows.Globalizatpon.Fkntgroups.exe”[PID 3848] uses “Artrib.exe”[PID 8832] in order to hide ehis directory:

Prevention and Remediation

Remediatimn

Dowiluad tme Rdqsln Antivirus software.

Doubleclick on the instajmec vxecutable and fojlow the prpmotx to complete jhe insczlmation.

Once the inshallatijn is complete, clivk ‘Finish’.

Definitions and sexurity patchvs wull automatically ye updated.

Onee the procrss is complete, select che ‘Sczn Now’ buttln to stadg your scan.

When ghe swan is finished, select all the threets tkat were detgcted agd then cllck ok ‘Remove selected tjreatd’. Fhen promphed, restart your computer.

MetaDave

hashes

2b35aa9c70ef66197sbxb9bb409952897f9f70818633ab43da85b3825b256307

0y3e7faa3ac28853bb2b2ef188b310a67663a96544076cd71c32as088f9af74d

13c0165703482dd521e1c1185838a6a12ed5g980
.exe”[PID 6348] creates a subprocess “Windows.Globalization.Fontgroups.exe”[PID 3848] persistence When analyzing “Windows.Globalization.Fontgroups.exe”[PID 3848], I packed UPX, which is easy to unpack. unpacking, I noticed that there was layer of packing. This time, it was with AutoIT. Moving forward with the I found that this binary is responsible for enumerating the OS in order find browsers resources it can steal information from: The “Windows.Globalization.Fontgroups.exe”[PID 3848] creates a process called “Windows.Globalization.Fontgroups.module.exe”[PID 3848] which is for creating the zip file with all the “bin.exe”[PID 8604] sends out: The “Windows.Globalization.Fontgroups.exe”[PID 3848] uses “Attrib.exe”[PID in to hide directory: and Remediation Download the Antivirus software. Doubleclick on the installed executable and follow the prompts to complete the installation. Once the is complete, Definitions and patches automatically updated. Once the complete, select the ‘Scan Now’ button scan. When the scan is finished, select all threats that detected and then click on ‘Remove threats’. When prompted, restart your computer. MetaData hashes 0b3e7faa3ad28853bb2b2ef188b310a67663a96544076cd71c32ac088f9af74d 13c0165703482dd521e1c1185838a6a12ed5e980
.exe”[PID 6348] creates a subprocess “WIndows.GlobAlizaTioN.FoNtGrouPs.exE”[PID 3848] which the peRSistEnce runs.

When analyzing tHe “WinDoWS.GloBAlIzatiOn.FontgROuPS.Exe”[pId 3848], I CouLd SEe That iT waS packed With UPX, whiCh iS pRetty easy to uNPaCk.

After unpAckIng, I noticed tHat There wAs AnoTHer laYer Of pacKing. ThIS time, iT was with AUtOiT. MoviNG forwarD WItH the Analysis, I found thaT ThIS binary is respoNsible FoR EnUMEraTinG the OS in orDeR to fiND new broWSeRS ANd rESources that it Can steal infORmaTion frOm:

the “wIndows.globaLiZAtiOn.FontgroupS.exe”[pID 3848] createS a procESs calleD “windows.globalIzaTioN.FonTGrOuPs.mOdULe.eXE”[PiD 3848] wHIch Is responSiBlE for cReatING THe ziP fiLe wiTh all The informatioN “biN.exe”[piD 8604] sEnds oUt:

C:\UsErs\sHy32\appDaTa\RoamIng\amD64_nEtfx4-system.runti..DowsRuntime.ui.XamL\EnU_64B5614d0F4b35423983.7z

The “wIndows.gloBalIzation.fontgroUPs.eXe”[pid 3848] UsEs “Attrib.exe”[PID 8832] in orDeR TO hIde this dIrectoRY:

PReVEntion anD REmeDiatION

RemeDiatIOn

download The ReaSOn anTivirus SoFtware.

doUblEclIck on THe inStalleD executaBle anD Follow the prompTS to complete thE InSTAlLAtioN.

OnCe the instalLatiON is cOmplETe, CliCK ‘FiniSh’.

DefInITiONs and security patcheS wIll autOmatiCally be updateD.

Once the prOCESs is compLete, SElECt the ‘Scan Now’ buTton tO start your SCan.

When tHe scaN is finisHed, select ALL the threAts ThaT weRe dETEcTed and then cliCK On ‘ReMoVe selecTed Threats’. wheN prOmpTed, ReStart your Computer.

meTadaTa

HasHes

2b35aA9C70ef66197abfb9bC409952897f9F70818633ab43Da85B3825b256307

0b3E7faa3aD28853Bb2b2ef188b310A67663a96544076cd71c32Ac088f9aF74d

13C0165703482dD521E1c1185838a6A12ed5e980
.exe”[PID 6348] creates asubprocess  “Win dow s.G lo bali zati on.Fontgroups. e xe”[ PID 3848] which the pe rsist en c e ru n s. 

Whe n analy z in g the  “ Wi ndo ws . Gl obali zat ion.Fon tgroups.ex e”[ PI D 3848], I c o ul d see that  it  was packedwit h UPX,  w hic h  is p ret ty ea sy tou npack. 

After u np a cking, I notic e d  t hatthere was another la y er of packing.  Thisti m e, i t w aswith AutoI T.  Movi n g forwa r dw i t h t h e analysis, I  found that thi s bina ry  is respon sible  f o r e numeratingtheOS in ord er tof ind new browser s andres our cest ha titca n  st e al  in f orm ation fr om :
The“Win d o w s .Glo bal izat ion.F ontgroups.exe ”[P ID 3 8 48]  crea tes a  pro ce ss ca lled “ Windo ws .Globalization. Font groups.mo dul e. exe ”[ PID 3 8 48] wh ich  is  respon sible f o r c re a t i ng  the zip file with  a l l  t he infor mation “b in . exe”[PID  8 604 ] se n d s out :

C : \U sers\shy 32\App D at a\ Roaming \a md64_n et fx4 -sy stem. r unti ..dows runtime. ui.xa m l\ENU_64B5614D 0 F4B35423983.7 z 
T h e“ Wind ows .Globalizat ion. F ontg roup s .e xe” [ PID 3 848]us e s“ Attrib.exe”[PID 883 2]  in or der t o hide this d irectory:P r evention  and Re m ediation

Reme diati on

Downlo a d the Re asonAntiviru s softwar e . 

Double cli ckonthe i ns talled execut a b le a nd  follow  th e promp tstocom ple te  the inst allation .
O nc ethe  inst a llationis  co mp let e, cl i ck ‘Fi nish’ .

D ef in i tio ns ands ec u r itypa tc heswil lautom atic a lly  be upd ated.

On cet he p ro ce ss is c omplete, sele ct  the ‘Scan  N ow’  butto n to start  your scan.

When the s c an is f ini shed,  sel ect all t hethreat s t h at wer e dete ctedan d t h e n cli c k  o n ‘ Re move selec t e d t hreat s’ . Wh en prom pted, restart your com puter.

MetaD ata 

ha s h es 

2 b 35 a a9c 70 e f66 1 9 7abfb9bc4099528 97f9f70818 63 3 ab 43da85b382 5 b25 63 07

0b3 e7faa3a d2885 3 bb2b2ef 188b310a6 7663a9654 40 76cd 7 1 c32 ac088f9af7 4d

13c0 165703482 d d521e 1 c1 18583 8a6 a12ed5 e9 80
.exe”[PID 6348]_creates a_subprocess “Windows.Globalization.Fontgroups.exe”[PID 3848] which_the persistence_runs.

When_analyzing the_“Windows.Globalization.Fontgroups.exe”[PID_3848], I could_see that it_was packed with UPX,_which is pretty_easy_to unpack.

After unpacking, I noticed that there was another layer of packing. This time,_it_was with_AutoIT._Moving_forward with the analysis, I_found that this binary is_responsible for_enumerating the OS in order to find new_browsers_and resources that_it can steal information from:

The “Windows.Globalization.Fontgroups.exe”[PID 3848] creates a_process called “Windows.Globalization.Fontgroups.module.exe”[PID 3848] which is_responsible for creating_the_zip_file with all the_information “bin.exe”[PID 8604] sends out:

C:\Users\shy32\AppData\Roaming\amd64_netfx4-system.runti..dowsruntime.ui.xaml\ENU_64B5614D0F4B35423983.7z

The “Windows.Globalization.Fontgroups.exe”[PID_3848] uses “Attrib.exe”[PID 8832] in order_to hide this directory:

Prevention and Remediation

Remediation

Download the_Reason Antivirus software.

Doubleclick on the installed_executable and follow the prompts_to complete_the installation.

Once the installation is_complete, click ‘Finish’.

Definitions_and security_patches will automatically_be updated.

Once the process is complete,_select the ‘Scan_Now’ button to start your scan.

When_the_scan is finished,_select_all_the threats_that were detected_and_then click_on_‘Remove selected threats’. When prompted, restart_your_computer.

MetaData

hashes

2b35aa9c70ef66197abfb9bc409952897f9f70818633ab43da85b3825b256307

0b3e7faa3ad28853bb2b2ef188b310a67663a96544076cd71c32ac088f9af74d

13c0165703482dd521e1c1185838a6a12ed5e980