Technical Information
Malicious functions
Patches code
in AMSI dll
- werfault_ydpv.exe process, Amsi.dll module
in NTDLL dll
- werfault_ydpv.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\microsoft\netframework\breadcrumbstore\e553551f68ac40ee874f34335b155cb6\werfault_ydpv.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
Sets the 'hidden' attribute to the following files
- %TEMP%\microsoft\netframework\breadcrumbstore\e553551f68ac40ee874f34335b155cb6\werfault_ydpv.exe
Network activity
Connects to
- '15#.#4.209.223':5173
TCP
Other
- '15#.#4.209.223':5173
Miscellaneous
Creates and executes the following
- '%TEMP%\microsoft\netframework\breadcrumbstore\e553551f68ac40ee874f34335b155cb6\werfault_ydpv.exe' "<Full path to file>"
