Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%TEMP%\hcl_ccen.exe'
Injects code into
the following system processes:
- %WINDIR%\syswow64\help.exe
Modifies file system
Creates the following files
- %TEMP%\hcl_ccen.exe
Network activity
Connects to
- '10#.#7.130.167':80
TCP
HTTP GET requests
- http://10#.#7.130.167/spaceX/csrssop.EXE
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Executes the following
- '%CommonProgramFiles(x86)%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\help.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe'
