Technical Information
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\asc.vbs"
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c ren %tmp%\yy y.js&cSCript %tmp%\y.js C
Modifies file system
Creates the following files
- %TEMP%\yy
- %TEMP%\xx
- %TEMP%\error025600_01.xml
- %ALLUSERSPROFILE%\asc.vbs
Deletes the following files
- %TEMP%\y.js
- %TEMP%\xx.vbs
- %ALLUSERSPROFILE%\asc.vbs
Moves the following files
- from %TEMP%\yy to %TEMP%\y.js
- from %TEMP%\xx to %TEMP%\xx.vbs
Network activity
UDP
- DNS ASK ba##tzi.xyz
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\y.js C
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\xx.vbs
- '%WINDIR%\syswow64\cmd.exe' /c ren %tmp%\yy y.js&cSCript %tmp%\y.js C' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cscript %TEMP%\xx.vbs' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c cscript %TEMP%\xx.vbs
