Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\sdszfo.docx
Modifies file system
Creates the following files
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-135.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-49-306.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-49-506.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-032.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-077.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-098.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-367.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-485.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-501.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-502.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-794.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-824.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-829.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-861.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-50-862.dump
- %TEMP%\rad3b794.tmp
- %TEMP%\content\3508-3908-wscript.exe-23-37-51-288.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-51-289.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-52-238.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-52-285.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-52-331.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-52-407.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-49-258.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-52-500.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-49-248.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-48-579.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-273.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-363.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-428.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-459.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-469.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-489.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-490.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-568.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-579.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-642.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-657.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-675.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-714.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-46-720.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-47-142.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-47-226.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-47-820.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-47-821.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-48-433.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-48-512.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-48-558.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-49-113.dump
- %TEMP%\content\3508-3908-wscript.exe-23-37-52-501.dump
Substitutes the following files
- %ProgramFiles%\UNP\Logs\UpdateNotificationPipeline.001.etl
Network activity
TCP
HTTP GET requests
- http://sw###hman.com/lDg4wT.exe
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?28##############
UDP
- DNS ASK ti####.###dacionlittleangels.com
- DNS ASK sw###hman.com
- DNS ASK share.microsoft.com
- DNS ASK go.microsoft.com
- DNS ASK settings-win.data.microsoft.com
- DNS ASK maps.windows.com
- DNS ASK dl.delivery.mp.microsoft.com
- DNS ASK ar#.msn.com
- DNS ASK im##########-rt-microsoft-com.akamaized.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\rad3B794.tmp' (with hidden window)
Executes the following
- '<SYSTEM32>\wscript.exe' /b /nologo <PATH_SAMPLE>.js
- '<SYSTEM32>\cmd.exe' /c %TEMP%\rad3B794.tmp
- '<SYSTEM32>\devicecensus.exe' UserCxt
- '<SYSTEM32>\svchost.exe' -k netsvcs -p
