Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\nse2.tmp\ns4.tmp' <SYSTEM32>\cmd.exe /C Sc delete AdobeFlashPlayerHash
- '%TEMP%\nse2.tmp\ns3.tmp' <SYSTEM32>\cmd.exe /C net stop AdobeFlashPlayerHash
Executes the following:
- '<SYSTEM32>\cmd.exe' /C Sc delete AdobeFlashPlayerHash
- '<SYSTEM32>\sc.exe' delete AdobeFlashPlayerHash
- '<SYSTEM32>\net1.exe' stop AdobeFlashPlayerHash
- '<SYSTEM32>\cmd.exe' /C net stop AdobeFlashPlayerHash
- '<SYSTEM32>\net.exe' stop AdobeFlashPlayerHash
Modifies file system:
Creates the following files:
- %TEMP%\nse2.tmp\ns3.tmp
- %TEMP%\nse2.tmp\ns4.tmp
- %TEMP%\nse2.tmp\nsExec.dll
- %WINDIR%\HhSm\parameters.ini
- %WINDIR%\HhSm\history.exe
Deletes the following files:
- %TEMP%\nse2.tmp\ns3.tmp
