Technical Information
Triggers a user-defined sigma rule:
- d223b46b-5621-4037-88fe-fda32eead684
Modifies file system
Creates the following files
- <Current directory>\geogepkhnbwd.exe
- <Current directory>\.hwfreetb_rand.txt
- %HOMEPATH%\documentsthwlree\+ttworkink_auth.dll
Deletes following files that it created itself
- <Current directory>\.hwfreetb_rand.txt
Deletes itself.
Network activity
Connects to
- 'wo#########-distribution.workink.click':443
- '19#.#32.214.172':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0a##############
Other
- 'wo#########-distribution.workink.click':443
UDP
- DNS ASK wo#########-distribution.workink.click
Miscellaneous
Creates and executes the following
- '<Current directory>\geogepkhnbwd.exe' --del-old "<Full path to file>" --mark-rand
