Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' shell32.dll,ShellExec_RunDLL "%APPDATA%\mICroSOFt\wINDOWs\StArT MENu\Ganmk2 Gk3o ADk30.lnk"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1508
Modifies file system
Creates the following files
- %LOCALAPPDATA%\viberpendingupdate\sgsdgkjsgkljsegseuigh38g.dll
- %APPDATA%\microsoft\windows\start menu\ganmk2 gk3o adk30.lnk
- %TEMP%\936630.cvr
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' "%LOCALAPPDATA%\VibErpEnDINgUpDaTe\sgsdgkjsgkljsegseuigh38g.dll",IETrackingProtectionEnabled
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%LOCALAPPDATA%\VibErpEnDINgUpDaTe\sgsdgkjsgkljsegseuigh38g.dll"
- '%WINDIR%\syswow64\rundll32.exe' "%LOCALAPPDATA%\VibErpEnDINgUpDaTe\sgsdgkjsgkljsegseuigh38g.dll",SetQueryNetSessionCount
- '<SYSTEM32>\rundll32.exe' shell32.dll,ShellExec_RunDLL "%APPDATA%\mICroSOFt\wINDOWs\StArT MENu\Ganmk2 Gk3o ADk30.lnk"' (with hidden window)
- '<SYSTEM32>\rundll32.exe' "%LOCALAPPDATA%\VibErpEnDINgUpDaTe\sgsdgkjsgkljsegseuigh38g.dll",IETrackingProtectionEnabled' (with hidden window)
