Technical Information
Malicious functions
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /C rundll32 %tmp%\Client.txt,IEX A C
- '%WINDIR%\syswow64\grpconv.exe'
Injects code into
the following system processes:
- %WINDIR%\syswow64\grpconv.exe
the following user processes:
- winword.exe
Modifies file system
Creates the following files
- %TEMP%\client.txt
- %TEMP%\wc478b.tmp
Deletes the following files
- %TEMP%\client.txt
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C rundll32 %tmp%\Client.txt,IEX A C' (with hidden window)
- '%ProgramFiles(x86)%\windows photo viewer\imagingdevices.exe' ' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\rundll32.exe' %TEMP%\Client.txt,IEX A C
- '<SYSTEM32>\rundll32.exe' %TEMP%\Client.txt,IEX A C
- '%ProgramFiles(x86)%\windows photo viewer\imagingdevices.exe'
