Technical Information
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\cscript.exe' %PROGRAMDATA%\asc.txt:script1.vbs
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c ren %tmp%\zz j&wSCRipT %tmp%\j?.wsf C C
Modifies file system
Creates the following files
- %TEMP%\zz
- %TEMP%\xx
- %PROGRAMDATA%\asc.txt:script1.vbs
Deletes the following files
- %TEMP%\j
- %TEMP%\xx.vbs
Moves the following files
- from %TEMP%\zz to %TEMP%\j
- from %TEMP%\xx to %TEMP%\xx.vbs
Network activity
Connects to
- '79.##4.8.120':80
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\xx.vbs
- '%WINDIR%\syswow64\cmd.exe' /c ren %tmp%\zz j&wSCRipT %tmp%\j?.wsf C C' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cscript %TEMP%\xx.vbs' (with hidden window)
- '<SYSTEM32>\cscript.exe' %PROGRAMDATA%\asc.txt:script1.vbs' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\wscript.exe' %TEMP%\j?.wsf C C
- '%WINDIR%\syswow64\cmd.exe' /c cscript %TEMP%\xx.vbs
