Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im Cookies.exe
Modifies file system:
Creates the following files:
- %TEMP%\7ZipSfx.000\CookiesERR.cmd
- %TEMP%\7ZipSfx.000\CookiesERR.lnk
- %TEMP%\7ZipSfx.000\Cookies.sys
- %HOMEPATH%\CookiesERR\Cookies.exe
- %TEMP%\7ZipSfx.000\Document Microsoft Office.docx
- %TEMP%\7ZipSfx.001\Cookies.cmd
- %TEMP%\7ZipSfx.001\Cookie.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%HOMEPATH%\CookiesERR\Cookies.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\CookiesERR.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.001\Cookies.cmd" "
- '<SYSTEM32>\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyServer"
- '<SYSTEM32>\reg.exe' Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
- '<SYSTEM32>\find.exe' /I "ProxyServer"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %TEMP%\7ZipSfx.000\Document Microsoft Office.docx
- '<SYSTEM32>\cmd.exe' /c Reg.exe Query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"|Find /I "ProxyUser"
- '<SYSTEM32>\find.exe' /I "ProxyUser"
