Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\onedrivestandaloneupdater
Malicious functions
Creates and executes the following (exploit)
- '%ALLUSERSPROFILE%\office356\menorah' Of
Executes the following (exploit)
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1992
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\office356\menorah
- %ALLUSERSPROFILE%\office356\menorah.config
- %TEMP%\1213282.cvr
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\office356\menorah' Of' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {3F929498-AFD5-4D7F-B854-6250237EE58B} S-1-5-21-1238866942-1249195528-555854008-1000:tihxzxtswp\user:Interactive:[1]
