Technical Information
Malicious functions
Creates and executes the following
- '%TEMP%\wtaajw.exe'
Modifies file system
Creates the following files
- %TEMP%\wtaajw.exe
- %TEMP%\nsf1342.tmp
- %HOMEPATH%\fumigate\chirinola\minimallnnedes.ops
- %HOMEPATH%\fumigate\chirinola\hankenes177\ripup253\mapiproxy.dll
- %HOMEPATH%\fumigate\chirinola\hankenes177\ripup253\potensfunktionerne.cah
- %HOMEPATH%\fumigate\chirinola\pyong\handelskb\wigwamens\microsoft.practices.unity2.dll
- %HOMEPATH%\fumigate\chirinola\pyong\handelskb\wigwamens\insert-link-symbolic.svg
- %HOMEPATH%\fumigate\chirinola\atrabilious\super_pi_mod.exe
- %TEMP%\nsf1565.tmp\nsexec.dll
- %TEMP%\nsf1565.tmp\system.dll
Network activity
Connects to
- '10#.#06.240.194':80
TCP
HTTP GET requests
- http://10#.#06.240.194/cxz/DHL.exe
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x4D^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x3B^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x73^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2A^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2D^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x36^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x22^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x62^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x55^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6C^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x60^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x34^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x3A^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x35^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x32^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x33^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x7B^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2F^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x37^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x23^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x4F^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x30^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x31^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x39^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x40^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x71^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x50^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x76^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x66^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x45^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6A^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6F^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x42^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2B^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6E^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x46^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x77^3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x53^3"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x4D^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x3B^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x73^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2A^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2D^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x36^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x22^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x62^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x55^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6C^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x60^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x34^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x3A^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x35^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x32^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x33^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x7B^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2F^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x37^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x23^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x4F^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x30^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x31^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x39^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x40^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x71^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x50^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x76^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x66^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x45^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6A^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6F^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x42^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x2B^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x6E^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x46^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x77^3"
- '%WINDIR%\syswow64\cmd.exe' /c sET /a "0x53^3"
