Cybercriminals are targeting gamers with “mining malware” via cracked games

“Crackonosh” malware is being hidden in free versions of games like NBA 2K19, Grand Theft Auto V, Far Cry 5, The Sims 4 and Jurassic World Evolution, which are available to download on torrent sites, Avast said on Thursday.

Crackonosh is distributed along with illegal, cracked copies of popular software and searches for and disables many popular antivirus programs as part of its anti-detection and anti-forensics tactics.

The main target of Crackonosh was the installation of the coinminer XMRig.

Crackonosh installs itself by replacing critical Windows system files and abusing the Windows Safe mode to impair system defenses.

This malware further protects itself by disabling security software, operating system updates and employs other anti-analysis techniques to prevent discovery, making it very difficult to detect and remove.

In summary, Crackonosh shows the risks in downloading cracked software and demonstrates that it is highly profitable for attackers.

-AVAST

1. First, the victim runs the installer for the cracked software.
2. The installer runs maintenance.vbs
3. Maintenance.vbs then starts the installation using serviceinstaller.msi
4. Serviceinstaller.msi registers and runs serviceinstaller.exe, the main malware executable.
5. Serviceintaller.exe drops StartupCheckLibrary.DLL.
6. StartupCheckLibrary.DLL downloads and runs wksprtcli.dll.
7. Wksprtcli.dll extracts newer winlogui.exeand drops winscomrssrv.dll and winrmsrv.exewhich it contains, decrypts and places in the folder.

Removal of Crackonosh

The following steps are required to fully remove Crackonosh.

Delete the following Scheduled Tasks (Task Schedulers)

Microsoft\Windows\Maintenance\InstallWinSAT
Microsoft\Windows\Application Experience\StartupCheckLibrary
Microsoft\Windows\WDI\SrvHost\
Microsoft\Windows\Wininet\Winlogui\
Microsoft\Windows\Windows Error Reporting\winrmsrv\

Delete the following files from c:\Windows\system32\

7B296FC0-376B-497d-B013-58F4D9633A22-5P-1.B5841A4C-A289-439d-8115-50AB69CD450
7B296FC0-376B-497d-B013-58F4D9633A22-5P-1.B5841A4C-A289-439d-8115-50AB69CD450B
diskdriver.exe
maintenance.vbs
serviceinstaller.exe
serviceinstaller.msi
startupcheck.vbs
startupchecklibrary.dll
windfn.exe
winlogui.exe
winrmsrv.exe
winscomrssrv.dll
wksprtcli.dll

Delete the following file from C:\Documents and Settings\All Users\Local Settings\Application Data\Programs\Common (%localappdata%\Programs\Common)
UserAccountControlSettingsDevice.dat

Delete the following file from C:\Program Files\Windows Defender\
MSASCuiL.exe

Delete the following Windows registry keys (using regedit.exe)

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender value DisableAntiSpyware
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value DisableBehaviorMonitoring
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value DisableOnAccessProtection
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection value DisableScanOnRealtimeEnable
HKLM\SOFTWARE\Microsoft\Security Center value AntiVirusDisableNotify
HKLM\SOFTWARE\Microsoft\Security Center value FirewallDisableNotify
HKLM\SOFTWARE\Microsoft\Security Center value UpdatesDisableNotify
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer value HideSCAHealth
HKLM\SOFTWARE\Microsoft\Windows Defender\Reporting value DisableEnhancedNotifications
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value winlogui

Restore the following default Windows services (Note: depends on your OS version – see https://www.tenforums.com/tutorials/57567-restore-default-services-windows-10-a.html)

wuauserv
SecurityHealthService
WinDefend
Sense
MsMpSvc
Reinstall Windows Defender and any third-party security software, if any was installed.

Error messages
On infected machines, sometimes the following error messages about the file Maintenance.vbs can appear.

Type Mismatch: ‘CInt’, Code: 800A000D
Can not find script file

Both of these are bugs in the Crackonosh installation.

Source: https://decoded.avast.io/danielbenes/crackonosh-a-new-malware-distributed-in-cracked-software/