Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\verclsid.exe' /C {BDEADF00-C265-11D0-BCED-00A0C90AB50F} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
- '<SYSTEM32>\wscript.exe' "C:\DOCUME~1\user\LOCALS~1\Temp\system roots.vbs"
Modifies file system
Creates the following files
- C:\Documents\user\locals~1\temp\~df906f.tmp
- C:\Documents\user\locals~1\temp\system roots.vbs
- %HOMEPATH%\nethood\my web sites on msn\desktop.ini
- %HOMEPATH%\nethood\my web sites on msn\target.lnk
Network activity
Connects to
- '19#.#.216.144':80
TCP
HTTP GET requests
- http://19#.#.216.144/mgp/MGPOMGPOMGPOMGPOMGPOMPGOMPGOMMGI%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23MGPOMPGOMPGMGPOMGPOMG.DOC
- http://19#.#.216.144/778/system%20roots.vbs
Miscellaneous
Searches for the following windows
- ClassName: 'Ghost' WindowName: ''
- ClassName: 'MsoHelp11' WindowName: ''
- ClassName: 'AgentAnim' WindowName: ''
Executes the following
- '%ProgramFiles%\microsoft office\office12\winword.exe' -Embedding
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
