Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' shell32.dll,ShellExec_RunDLL %TEMP%\asdfgh.lnk
Modifies file system
Creates the following files
- %TEMP%\vswebview2cache\asdfhcxh.dll
- %TEMP%\asdfgh.lnk
Moves the following files
- from %TEMP%\vswebview2cache\asdfhcxh.dll to %TEMP%\modemui.dll
- from %TEMP%\modemui.dll to %TEMP%\tmpbdb3.tmp
Network activity
Connects to
- 'fr###l.space':443
TCP
Other
- 'fr###l.space':443
UDP
- DNS ASK fr###l.space
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' shell32.dll,ShellExec_RunDLL %TEMP%\asdfgh.lnk' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /u /s "%TEMP%\VSWebView2Cache\asdfhcxh.dll"' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\modemui.dll",CountryRunOnce' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /u /s "%TEMP%\VSWebView2Cache\asdfhcxh.dll"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\modemui.dll",CountryRunOnce
