Technical Information
Malicious functions
Creates and executes the following (exploit)
- 'C:\users\public\calc.exe'
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\hg32j.bat
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\kjh4ek\ndj34h.bat
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1348
Injects code into
the following system processes:
- <SYSTEM32>\wermgr.exe
Modifies file system
Creates the following files
- C:\users\public\hg32j.bat
- C:\users\public\calc.exe
- C:\users\public\kjh4ek\ndj34h.bat
- %HOMEPATH%\application data\microsoft\forms\winword.box
- %TEMP%\927847.cvr
- %TEMP%\log4f57.tmp
Deletes the following files
- %TEMP%\log4f57.tmp
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c mkdir C:\Users\Public\kjh4ek
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 1
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 1
- '<SYSTEM32>\wermgr.exe'
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\hg32j.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c C:\Users\Public\kjh4ek\ndj34h.bat' (with hidden window)
