Change 'Win32_Services' to match your environment

[jijoalfonso]

Hi,

One of my PC got infected by WannaMine. I downloaded the WannaMineCleaner and noticed on the script, it mentioned "change 'Win32_Services' to match your environment".

May I know if Win32_Services is the default environment or not? If not, how can I know the exact environment?

I have the decode base64 if you needed.

Thank you.

[christofersimbar]

Hi @jijoalfonso please refer to the following blog post
https://medium.com/@christoferdirk/cryptomining-malware-is-using-wmi-to-evade-antivirus-detection-248a91a620b9
I know the Win32_Services is a malicious class because it was mentioned in the powershell command line of the malware process.

[jijoalfonso]

Hi @christofersimbar , based on the link given, I need to use wbemtest.exe on affected PC before I can know the malicious class. For the Malicious Instance, I already know it was originated from SCM Event Log Consumer and SCM Event Log Filter.

[christofersimbar]

@jijoalfonso You can use Task Manager to identify the malicious process, this malware usually run a powershell script. You can identify the malicious class name from this script. Make sure you show the Command Line column by right-clicking on any column, then click on Command Line. After that you can verify the content of malicious class by using wbemtest.exe. This is important so that you don't accidentally delete legitimate class.

[jijoalfonso]

@christofersimbar thank you for your feedback. Been dealing with this WannaMiner for months. FYI, before this I had deleted the WMI-Object but it appear again.

May I know if the endpoint is affected again by wannaminer after using the script?

[christofersimbar]

@jijoalfonso If it appears again then it means you have not deleted all the malicious instances in root\subscription namespace, or maybe there is a vulnerability in your system. You need to identify how the malware got into your system, then patch the vulnerability. It cannot just infected the machine without exploiting a known vulnerability. Other possible cause, is maybe the username and password is shared with other infected system (this is very common in corporate environment).

[jijoalfonso]

@christofersimbar I see. Thank you for your reply and suggestion. I'll try the script on the affected machines and patch the endpoints.