Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Imcwe34ages' = '%ALLUSERSPROFILE%\imagewgjktr3s.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\programs.bat
- %APPDATA%\microsoft\windows\start menu\programs\startup\programs.bat:start
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\imagewgjktr3s.exe
- %ALLUSERSPROFILE%:applicationdata
Network activity
Connects to
- '19#.#42.59.216':5200
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\imagewgjktr3s.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '%WINDIR%\syswow64\cmd.exe'
