Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- <Current directory>\16961000
Substitutes the following files
- <PATH_SAMPLE>.xlsx
Network activity
Connects to
- '10#.#73.192.152':80
- 'ch####p.dyndns.org':80
TCP
HTTP GET requests
- http://10#.#73.192.152/receipt/receipt.doc?&w####################################################################################################################################################...
- http://10#.#73.192.152/143/vbc.exe
- http://ch####p.dyndns.org/
UDP
- DNS ASK ch####p.dyndns.org
Miscellaneous
Executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' -Embedding
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
