Technical Information
Malicious functions
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1472
Modifies file system
Creates the following files
- %APPDATA%\1f003.xsl
- %TEMP%\1113659.cvr
Network activity
Connects to
- 'we####ssway.co.za':443
- 'yo#####suratkumar.com':443
- 'ab##it.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'yo#####suratkumar.com':443
- 'ab##it.com':443
UDP
- DNS ASK ho#####dblessing.com
- DNS ASK we####ssway.co.za
- DNS ASK mi###pharma.com
- DNS ASK us###tnet.co.uk
- DNS ASK dr###itelite.it
- DNS ASK ku###oding.com
- DNS ASK te###urver.nl
- DNS ASK yo#####suratkumar.com
- DNS ASK go###llet.com
- DNS ASK ab##it.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'COnSoLewInDoWClasS' WindowName: ''
Executes the following
- '<SYSTEM32>\wbem\wmic.exe'
- '<SYSTEM32>\wbem\wmic.exe' ' (with hidden window)
