Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\name
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\folder\file.exe
- %TEMP%\17d691995f9d4f47a2b74bcdcd0e85fe.xml
Deletes itself.
Network activity
UDP
- DNS ASK he####aze420.com
- DNS ASK 4m###l1mit.com
- DNS ASK my#####prisedesk.com
- DNS ASK ne####ka.digital
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\17d691995f9d4f47a2b74bcdcd0e85fe.xml"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN name /XML "%TEMP%\17d691995f9d4f47a2b74bcdcd0e85fe.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN name /XML "%TEMP%\17d691995f9d4f47a2b74bcdcd0e85fe.xml"
- '%WINDIR%\syswow64\wscript.exe'
- '%WINDIR%\syswow64\cmd.exe' del "<Full path to file>"
