Technical Information
Malicious functions
Creates and executes the following
- '<SYSTEM32>\cscript.exe' //nologo "%TEMP%\run_bat.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Expand-Archive -Path '%TEMP%\base.zip' -DestinationPath '%LOCALAPPDATA%\Temp' -Force
Modifies file system
Creates the following files
- %TEMP%\a.txt
- %TEMP%\b.txt
Moves the following files
- from %TEMP%\a.txt to %TEMP%\bat2.bat
- from %TEMP%\b.txt to %TEMP%\run_bat.vbs
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\bat2.bat
- '<SYSTEM32>\cmd.exe' /c %TEMP%\bat2.bat' (with hidden window)
