Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /S ..\elv1.ooocccxxx
- '<SYSTEM32>\regsvr32.exe' /S ..\elv2.ooocccxxx
- '<SYSTEM32>\regsvr32.exe' /S ..\elv3.ooocccxxx
- '<SYSTEM32>\regsvr32.exe' /S ..\elv4.ooocccxxx
Modifies file system
Creates the following files
- <Current directory>\5ffd0000
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'da###-tw.com':443
- 'sb#.###moshiwang.com':80
- 'co###upo.ac.zm':443
- 'ly.##lianyi.top':80
TCP
Other
- 'da###-tw.com':443
UDP
- DNS ASK da###-tw.com
- DNS ASK sb#.###moshiwang.com
- DNS ASK co###upo.ac.zm
- DNS ASK ly.##lianyi.top
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /S ..\elv1.ooocccxxx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\elv2.ooocccxxx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\elv3.ooocccxxx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\elv4.ooocccxxx' (with hidden window)
