Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\baCjBnr.dll,f1
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
- 'hi###bed.xyz':443
UDP
- DNS ASK hi###bed.xyz
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\baCjBnr.dll,f1' (with hidden window)
