Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im UPSecurityInput.exe
Modifies file system
Creates the following files
- %TEMP%\temp.vbs
Deletes the following files
- %TEMP%\temp.vbs
Deletes itself.
Network activity
UDP
- DNS ASK x.####k6t7m9p8.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\temp.vbs"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\1.jpg
- '%WINDIR%\syswow64\taskkill.exe' /f /im UPSecurityInput.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\1.jpg' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\temp.vbs"' (with hidden window)
