Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\conhost.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\install.exe
- %TEMP%\evb83b1.tmp
Deletes the following files
- %TEMP%\ixp000.tmp\install.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\ixp000.tmp\install.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item '%TEMP%\IXP000.TMP\install.exe' -Force
Executes the following
- '<SYSTEM32>\rundll32.exe' cache.dmp,cleanup
- '%TEMP%\ixp000.tmp\install.exe' ' (with hidden window)
- '<SYSTEM32>\rundll32.exe' cache.dmp,cleanup' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item '%TEMP%\IXP000.TMP\install.exe' -Force' (with hidden window)
