Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '6LDH_R4' = '%ProgramFiles(x86)%\Nllxlhh\taskhostkrj8efpp.exe'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Executes the following (exploit)
- '%ProgramFiles%\microsoft office\office14\excel.exe' /dde
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\a9r95vd6l_ps83ei_k4.tmp\has been verified. however pdf, jpeg, docx, .xlsx
- %TEMP%\a9r95vd6l_ps83ei_k4.tmp\~$has been verified. however pdf, jpeg, docx, .xlsx
- %TEMP%\649d.tmp
- C:\users\public\vbc.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
Deletes the following files
- C:\users\public\vbc.exe
Network activity
Connects to
- '10#.#75.3.11':80
- 'mw##w.com':80
- 'ba###rolo.com':80
- 'he###execs.com':80
- 'ni####svarela.com':80
- 'ca####lshubs.com':80
- 'su####reetwear.com':80
TCP
HTTP GET requests
- http://10#.#75.3.11/pap1/pap1.exe
- http://www.mw##w.com/agwu/?zH##########################################################################################
- http://www.ba###rolo.com/agwu/?zH##########################################################################################
- http://www.he###execs.com/agwu/?zH##########################################################################################
- http://www.ni####svarela.com/agwu/?zH##########################################################################################
- http://www.vs##e.com/agwu/?zH##########################################################################################
- http://www.ca####lshubs.com/agwu/?zH##########################################################################################
UDP
- DNS ASK mw##w.com
- DNS ASK ex####tesunni.com
- DNS ASK ba###rolo.com
- DNS ASK br###dom.com
- DNS ASK he###execs.com
- DNS ASK ni####svarela.com
- DNS ASK xi##t.store
- DNS ASK vs##e.com
- DNS ASK ca####lshubs.com
- DNS ASK su####reetwear.com
Miscellaneous
Searches for the following windows
- ClassName: 'XLMAIN' WindowName: 'Microsoft Excel (Product Activation Failed) - Book1'
- ClassName: 'XLMAIN' WindowName: ''
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\rundll32.exe'
- '%WINDIR%\syswow64\cmd.exe' del "C:\Users\Public\vbc.exe"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
