Technical Information
Malicious functions
Creates and executes the following
- '<SYSTEM32>\cmd.exe' (downloaded from the Internet)
Modifies file system
Creates the following files
- %TEMP%\ox_1761624116939.exe
- %TEMP%\ox_1761624116268.exe
- %TEMP%\ox_1761624117362.exe
- %TEMP%\ox_1761624116691.exe
- %TEMP%\ox_1761624116225.exe
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\9740vmxi\retev[2].htm
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\9740vmxi\retev[1].htm
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\9eb7x1g4\retev[1].htm
- %TEMP%\ox_1761624116268.exe
- %TEMP%\ox_1761624116939.exe
- %TEMP%\ox_1761624116691.exe
- %TEMP%\ox_1761624117362.exe
- %TEMP%\ox_1761624116225.exe
Network activity
Connects to
- 'vc######stributable.help':443
- '19#.#32.210.172':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d6##############
Other
- 'vc######stributable.help':443
UDP
- DNS ASK vc######stributable.help
Miscellaneous
Creates and executes the following
- '%TEMP%\ox_1761624116268.exe'
- '%TEMP%\ox_1761624116939.exe'
- '%TEMP%\ox_1761624116691.exe'
- '%TEMP%\ox_1761624117362.exe'
- '%TEMP%\ox_1761624116225.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' start %TEMP%\ox_1761624116268.exe
- '<SYSTEM32>\cmd.exe' start %TEMP%\ox_1761624116939.exe
- '<SYSTEM32>\cmd.exe' start %TEMP%\ox_1761624116691.exe
- '<SYSTEM32>\cmd.exe' start %TEMP%\ox_1761624116225.exe
- '<SYSTEM32>\cmd.exe' start %TEMP%\ox_1761624117362.exe
