Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\register-cimprovider.url
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\srt4rtghnmjklfgdr54gpro4.scr'
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\srt4rtghnmjklfgdr54gpro4.scr
- %HOMEPATH%\register-cimprovider\register-cimprovider.vbs
- %HOMEPATH%\register-cimprovider\authfwcfg.exe
Network activity
TCP
HTTP GET requests
- http://ma###-bg.com/xmlInstall/adkp.scr
UDP
- DNS ASK ma###-bg.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\svchost.exe'
