Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /PID 2888 /T /F
Modifies file system
Creates the following files
- %TEMP%\aut2358.tmp
- <Current directory>\lang\en-us.ini
- <PATH_SAMPLE>.ini
- <PATH_SAMPLE>.vbs
- %TEMP%\aut276d.tmp
Deletes the following files
- %TEMP%\aut2358.tmp
- %TEMP%\aut276d.tmp
Network activity
Connects to
- 'tools.google.com':443
TCP
Other
- 'tools.google.com':443
UDP
- DNS ASK tools.google.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /PID 2888 /T /F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /PID 2888 /T /F
