Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im winword.exe
- '%WINDIR%\syswow64\taskkill.exe' /im /f cmstp.exe
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c CmD < "%tmP%\aaaaaaaaaa.txt" & exit c
Modifies file system
Creates the following files
- %TEMP%\aaaaaaaaaa.txt
- %TEMP%\hgidgcleqxg.txt
- %TEMP%\dedxvsfzaqhqgpe.sct
- %TEMP%\wyprkdcpte.doc
- %APPDATA%\microsoft\network\connections\cm\ .cmp
Deletes the following files
- %TEMP%\dedxvsfzaqhqgpe.sct
Network activity
TCP
HTTP GET requests
- http://se####.n-document.biz/humans.txt
UDP
- DNS ASK se####.n-document.biz
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c CmD < "%tmP%\aaaaaaaaaa.txt" & exit c' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f
- '%WINDIR%\syswow64\cmd.exe'
- '%ProgramFiles%\microsoft office\office14\winword.exe' "%TEMP%\wyprkdCpTe.doc"
- '<SYSTEM32>\cmstp.exe' /s /ns "%TEMP%\hgIdgCLEqxg.txt"
