Technical Information
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' "%WINDIR%\Temp\ermqgdalgt.js"
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1904
Modifies file system
Creates the following files
- %WINDIR%\temp\ermqgdalgt.js
- %TEMP%\1023772.cvr
Network activity
Connects to
- 'av#.com':443
- 'bi###fender.com':443
- 'es##.com':443
TCP
Other
- 'av#.com':443
- 'bi###fender.com':443
- 'es##.com':443
UDP
- DNS ASK av#.com
- DNS ASK bi###fender.com
- DNS ASK es##.com
- DNS ASK ja###eneet.com
