Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /PID 5940 /T /F
Modifies file system
Creates the following files
- %TEMP%\aute446.tmp
- <Current directory>\lang\en-us.ini
- <PATH_SAMPLE>.ini
- <PATH_SAMPLE>.vbs
Deletes following files that it created itself
- %TEMP%\aute446.tmp
Network activity
Connects to
- 'tools.google.com':443
TCP
Other
- 'tools.google.com':443
UDP
- DNS ASK tools.google.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /PID 5940 /T /F
- '<SYSTEM32>\cmd.exe' /c taskkill /PID 5940 /T /F' (with hidden window)
