Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ID_E2A96AA9' = 'wscript.exe //b %APPDATA%\Microsoft\Windows\CompPress\CompPress.vbs'
Creates or modifies the following files
- <SYSTEM32>\tasks\id_e2a96aa9
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' //b "%APPDATA%\gHjsfrf.vbs"
Modifies file system
Creates the following files
- %APPDATA%\ghjsfrf.vbs
- %APPDATA%\microsoft\windows\comppress\comppress.vbs
Deletes the following files
- %APPDATA%\ghjsfrf.vbs
Network activity
TCP
HTTP GET requests
- http://kr###in.website/vwasntvzioo_E2A96AA9/index_15_04.php
UDP
- DNS ASK kr###in.website
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' //b "%APPDATA%\gHjsfrf.vbs"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 13 /F /tn ID_E2A96AA9 /tr %APPDATA%\Microsoft\Windows\CompPress\CompPress.vbs' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 13 /F /tn ID_E2A96AA9 /tr %APPDATA%\Microsoft\Windows\CompPress\CompPress.vbs
