Technical Information
Malicious functions
Executes the following (exploit)
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "%TEMP%\A9Rhsue3y_2vlifd_358.tmp\Product Catalogue & Pricelist.doc"
Injects code into
the following user processes:
- rdrcef.exe
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\a9rhsue3y_2vlifd_358.tmp\product catalogue & pricelist.doc
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies-journal
- %TEMP%\etilqs_n2qnsq3orlps88x
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies
- %TEMP%\a9rtzn8zg_2vliff_358.tmp
Network activity
Connects to
- 'ab##zr.ma':80
TCP
HTTP GET requests
- http://www.ab##zr.ma/nokwar2.1.exe
UDP
- DNS ASK ab##zr.ma
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
