Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\gfxv2_0.url
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\908.exe'
Executes the following (exploit)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "%TEMP%\A9R6qrzyc_1sj23wq_ww.tmp\nnn.doc"
Modifies file system
Creates the following files
- %TEMP%\a9r6qrzyc_1sj23wq_ww.tmp\nnn.doc
- C:\users\public\908.exe
- %HOMEPATH%\gfxv2_0\gfxv2_0.vbs
- %HOMEPATH%\gfxv2_0\mstsc.exe
Network activity
TCP
HTTP GET requests
- http://bi#.ly/33MD9hU
- http://www.xu##s.com/wp-content/uploads/2019/10/mm.jpg
UDP
- DNS ASK bi#.ly
- DNS ASK xu##s.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
