Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\link_log
- <SYSTEM32>\tasks\one_drivers
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c C:\Drivres\Audio.bat
Modifies file system
Creates the following files
- %HOMEPATH%\documents\vb14da.tmp
- C:\drivres\audio.txt
- C:\drivres\one_drivers.txt
- %HOMEPATH%\adobe\driver\pdf\pid.txt
- %HOMEPATH%\adobe\driver\dwg\pid.txt
- %HOMEPATH%\documents\36731000
Deletes the following files
- %TEMP%\vb14c9.tmp
Moves the following files
- from %HOMEPATH%\documents\vb14da.tmp to %TEMP%\vb14c9.tmp
- from C:\drivres\audio.txt to C:\drivres\audio.bat
- from C:\drivres\one_drivers.txt to %HOMEPATH%\adobe\driver\pdf\one_drivers.txt
- from %HOMEPATH%\adobe\driver\pdf\one_drivers.txt to %HOMEPATH%\adobe\driver\pdf\one_drivers.vbs
- from %HOMEPATH%\documents\36731000 to %HOMEPATH%\documents\book1.xlsx
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c C:\Drivres\Audio.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\attrib.exe' +a +h +s "%HOMEPATH%\Adobe"
- '<SYSTEM32>\attrib.exe' +a +h +s "%HOMEPATH%\Daily"
- '<SYSTEM32>\schtasks.exe' /delete /tn Link_log /f
- '<SYSTEM32>\schtasks.exe' /delete /tn One_Drivers /f
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 10 /tn "Link_log" /tr %HOMEPATH%\Adobe\Driver\pdf\dphc.exe
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 20 /tn "One_Drivers" /tr %HOMEPATH%\Adobe\Driver\pdf\One_Drivers.vbs
