Check Point Meteor Aug 2021

Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.

Meteor can use `wmic.exe` as part of its effort to delete shadow copies.

Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.

Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.

Meteor can use PowerShell commands to disable the network adapters on a victim machines.

Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.

Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.

Meteor has the ability to discover the hostname of a compromised host.

Meteor has the ability to download additional files for execution on the victim's machine.

Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.

Meteor can use group policy to push a scheduled task from the AD to all network machines.

Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.

Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.

Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete`.

Meteor can change both the desktop wallpaper and the lock screen image to a custom image.

Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.

Meteor has the ability to change the password of local users on compromised hosts and can log off users.

Meteor can hide its console window upon execution to decrease its visibility to a victim.

Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.

Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.