Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\nsw2.tmp\ns4.tmp' <SYSTEM32>\cmd.exe /C Sc delete AdobeFlashPlayerHash
- '%TEMP%\nsw2.tmp\ns3.tmp' <SYSTEM32>\cmd.exe /C net stop AdobeFlashPlayerHash
Executes the following:
- '<SYSTEM32>\cmd.exe' /C Sc delete AdobeFlashPlayerHash
- '<SYSTEM32>\sc.exe' delete AdobeFlashPlayerHash
- '<SYSTEM32>\net1.exe' stop AdobeFlashPlayerHash
- '<SYSTEM32>\cmd.exe' /C net stop AdobeFlashPlayerHash
- '<SYSTEM32>\net.exe' stop AdobeFlashPlayerHash
Modifies file system:
Creates the following files:
- %TEMP%\nsw2.tmp\ns3.tmp
- %TEMP%\nsw2.tmp\ns4.tmp
- %TEMP%\nsw2.tmp\nsExec.dll
- %WINDIR%\HhSm\parameters.ini
- %WINDIR%\HhSm\Client.exe
Deletes the following files:
- %TEMP%\nsw2.tmp\ns3.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '#32770' WindowName: ''
