Technical Information
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' "%TEMP%\LL2h.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\w5I.vbs"
Executes the following (exploit)
- '%WINDIR%\explorer.exe' %TEMP%\LL2h.vbs
- '%WINDIR%\explorer.exe' %TEMP%\w5I.vbs
Modifies file system
Creates the following files
- %TEMP%\ll2h.vbs
- %TEMP%\bwzwi.txt
- %TEMP%\w5i.vbs
Deletes the following files
- %TEMP%\ll2h.vbs
- %TEMP%\bwzwi.txt
- %TEMP%\w5i.vbs
Network activity
TCP
HTTP GET requests
- http://an#####adrilling.com/wp-keys.php
UDP
- DNS ASK an#####adrilling.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\explorer.exe' %TEMP%\LL2h.vbs' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%TEMP%\LL2h.vbs"' (with hidden window)
- '%WINDIR%\explorer.exe' %TEMP%\w5I.vbs' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%TEMP%\w5I.vbs"' (with hidden window)
