Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im cmd
- '<SYSTEM32>\taskkill.exe' /f /im Avast secure browser
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\cmd.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\000814251_video_01.avi
Modifies file system
Creates the following files
- %TEMP%\10ef.tmp\10ff.tmp\1100.bat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020052620200527\index.dat
Deletes the following files
- %TEMP%\10ef.tmp\10ff.tmp\1100.bat
Network activity
TCP
- 'go###e.co.ck':443
- 'pr####ent360.com':443
- 'i.##img.com':443
- 'gs##tic.com':443
- 'en######d-tbn0.gstatic.com':443
UDP
- DNS ASK go###e.co.ck
- DNS ASK pr####ent360.com
- DNS ASK i.##img.com
- DNS ASK gs##tic.com
- DNS ASK en######d-tbn0.gstatic.com
- DNS ASK microsoft.com
- DNS ASK im#.#outube.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\10EF.tmp\10FF.tmp\1100.bat <Full path to file>"
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start star...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start star...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start sta...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start sta...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start ...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start ...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start ...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start ...
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start sta...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start sta...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start star...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start star...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start ...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start s...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start sta...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start s...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start s...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start s...
- '<SYSTEM32>\cmd.exe' /K start start start start start start start start start start start start start start start start start start start start start start start start start start start start start start st...
