Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\getcurrentprocess.venmousness.url
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\recovery\tree.exe
- %ALLUSERSPROFILE%\recovery\cfwd2.dat
- %ALLUSERSPROFILE%\recovery\cfwd3.dat
- %ALLUSERSPROFILE%\recovery\gamecap.exe
- %ALLUSERSPROFILE%\recovery\module_cfg.bin
- %ALLUSERSPROFILE%\recovery\server.vbe
- %ALLUSERSPROFILE%\recovery\setup.exe
- %ALLUSERSPROFILE%\recovery\unzip.exe
- %ALLUSERSPROFILE%\recovery\unzip.lnk
- %ALLUSERSPROFILE%\recovery\veeea.exe
- %TEMP%\is-dld2h.tmp\setup.tmp
Network activity
Connects to
- '45.##4.106.2':80
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\recovery\setup.exe'
- '%TEMP%\is-dld2h.tmp\setup.tmp' /SL5="$D0232,25047635,1145856,%ALLUSERSPROFILE%\Recovery\setup.exe"
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Recovery\Server.vbe" 0
- '%ALLUSERSPROFILE%\recovery\gamecap.exe'
- '%ALLUSERSPROFILE%\recovery\unzip.exe' -n -d "%APPDATA%" %ALLUSERSPROFILE%\Recovery\veeea.exe
- '%WINDIR%\syswow64\attrib.exe' C://ProgramData//Recovery +h' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c " ecHo\ -jOIn ( ( 53,74 ,61 , 72, 74 , 20 , 43 ,'3a' , '5c' , 50,72 ,'6f',67 ,72, 61, '6d', 44,61 , 74 ,61,'5c' ,52 , 65,63 ,'6f' ,76,65,72,79,'5c',73, 65, 74 ,75 ,70 , '2e' , 65, 78, 65 ,'...' (with hidden window)
- '<SYSTEM32>\attrib.exe' %ALLUSERSPROFILE%\Recovery +s +h' (with hidden window)
- '<SYSTEM32>\ipconfig.exe' /release' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Recovery\Server.vbe" 0' (with hidden window)
- '%ALLUSERSPROFILE%\recovery\gamecap.exe' ' (with hidden window)
- '<SYSTEM32>\ipconfig.exe' /renew' (with hidden window)
- '%ALLUSERSPROFILE%\recovery\unzip.exe' -n -d "%APPDATA%" %ALLUSERSPROFILE%\Recovery\veeea.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\attrib.exe' C://ProgramData//Recovery +h
- '%WINDIR%\syswow64\cmd.exe' /c " ecHo\ -jOIn ( ( 53,74 ,61 , 72, 74 , 20 , 43 ,'3a' , '5c' , 50,72 ,'6f',67 ,72, 61, '6d', 44,61 , 74 ,61,'5c' ,52 , 65,63 ,'6f' ,76,65,72,79,'5c',73, 65, 74 ,75 ,70 , '2e' , 65, 78, 65 ,'...
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" ecHo\ -jOIn ( ( 53,74 ,61 , 72, 74 , 20 , 43 ,'3a' , '5c' , 50,72 ,'6f',67 ,72, 61, '6d', 44,61 , 74 ,61,'5c' ,52 , 65,63 ,'6f' ,76,65,72,79,'5c',73, 65, 74 ,75 ,70 , '2e' , 65, 78, 6...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -cOMmAnd $ExeCuTIONcoNtexT.InvoKeCOMMand.INvOKESCRIPT( ${InpuT})
- '<SYSTEM32>\attrib.exe' %ALLUSERSPROFILE%\Recovery +s +h
- '<SYSTEM32>\ipconfig.exe' /release
- '<SYSTEM32>\ipconfig.exe' /renew
