Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%APPDATA%\microsoft\addins\u8x4m7s6.exe'
Executes the following (exploit)
- '<SYSTEM32>\certutil.exe' -decode %APPDATA%\Microsoft\AddIns\G6U6U9J7.txt %APPDATA%\Microsoft\AddIns\U8X4M7S6.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\addins\g6u6u9j7.txt
- %APPDATA%\microsoft\addins\u8x4m7s6.exe
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\certutil.exe' -decode %APPDATA%\Microsoft\AddIns\G6U6U9J7.txt %APPDATA%\Microsoft\AddIns\U8X4M7S6.exe' (with hidden window)
- '%APPDATA%\microsoft\addins\u8x4m7s6.exe' ' (with hidden window)
