Technical Information
Malicious functions
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 3176
Modifies file system
Creates the following files
- <Current directory>\~wrd0000.tmp
- %TEMP%\1172940.cvr
Moves the following files
- from <Current directory>\~wrd0000.tmp to <PATH_SAMPLE>.docx
Network activity
Connects to
- 'cd#.####es.express.co.uk':443
- 'x.##2.us':80
- 'o.##2.us':80
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.####ca1.amazontrust.com':80
- 'am#.spot.im':443
- 'cr#.####ca1.amazontrust.com':80
- 'st####.apester.com':443
- 'r3.#.lencr.org':80
- 'oc##.#tartssl.com':80
TCP
- 'cd#.####es.express.co.uk':443
- 'am#.spot.im':443
- 'st####.apester.com':443
UDP
- DNS ASK cd#.####es.express.co.uk
- DNS ASK x.##2.us
- DNS ASK o.##2.us
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK am#.spot.im
- DNS ASK cr#.####ca1.amazontrust.com
- DNS ASK st####.apester.com
- DNS ASK r3.#.lencr.org
- DNS ASK st####.rapidssl.com
- DNS ASK oc##.#tartssl.com
